tree 44070a1a39694872ff4e6f29a5d29cea643e7832
parent f5f71304b009f6f00fdd521a10295a5314d2ffa4
author Willy Tarreau <w@1wt.eu> 1503396086 +0200
committer Willy Tarreau <w@1wt.eu> 1503396226 +0200
encoding latin1

BUG/MEDIUM: dns: fix accepted_payload_size parser to avoid integer overflow

Since commit 9d8dbbc ("MINOR: dns: Maximum DNS udp payload set to 8192") it's
possible to specify a packet size, but passing too large a size or a negative
size is not detected and results in memset() being performed over a 2GB+ area
upon receipt of the first DNS response, causing runtime crashes.

We now check that the size is not smaller than the smallest packet which is
the DNS header size (12 bytes).

No backport is needed.