[PATCH] nslookup: fix out-of-bounds read on malformed TXT record
Ali Ahmet Memis via busybox <[email protected]>
| Newsgroups | gmane.linux.busybox |
|---|---|
| Message-ID | <[email protected]> |
The TXT record handler reads the character-string length byte and copies that many bytes without checking it against the record's RDLENGTH. A reply with rdlen==1 and a length byte of up to 255 makes memcpy() read past the record (and past the reply buffer); the data is then printed, disclosing adjacent memory. Clamp the length to the bytes actually present in RDATA. Signed-off-by: Ali Ahmet Memis <[email protected]> --- networking/nslookup.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/networking/nslookup.c b/networking/nslookup.c index b67d354f7..05ea28559 100644 --- a/networking/nslookup.c +++ b/networking/nslookup.c @@ -808,6 +808,9 @@ static NOINLINE int parse_reply(const unsigned char *msg, size_t len) return -1; } n = *(unsigned char *)ns_rr_rdata(rr); + /* Length byte can lie, clamp it to RDATA */ + if (n > rdlen - 1) + n = rdlen - 1; if (n > 0) { memset(dname, 0, sizeof(dname)); memcpy(dname, ns_rr_rdata(rr) + 1, n); -- 2.55.0