Re: libspf2 crash

I believe I've tracked down the issue. It has to do with 
SPF_dns_resolv_lookup(), and where it calls res_nquery(). Basically res_nquery() 
is returning 5600, a length greater than sizeof(response), which is a hard coded 
buffer size of 2048. Once the __ns_skiprr function reads past the 2048 bytes, 
your reading random data which is what's causing segfaults (and the Valgrind 
errors).

The solution is two fold. Increase the buffer size to 8196, and then check 
whether the return value of res_nquery() is less than 8196. If dns_len is 
greater than 8196, set it to 8196.

I believe what's happening, and I'd like confirmation on this, is res_nquery() 
is returning the amount of data it could read if the buffer length was 
sufficient. Its the client's responsibility to check whether this is greater 
than the buffer size (something libspf2 isn't doing). Anyone else have thoughts 
on this?

I'm running on CentOS 4.6.

Ladar Levison wrote:
> If you execute the attached code right now (Tuesday, 12:30am) you'll be 
> able to reproduce the crash. Note that these spammer domains disappear 
> often, so I'm not sure how long this will last. Also note I'm loading 
> the library dynamically, so update the code accordingly. The Valgrind 
> output is:
> 
> ==22263== Conditional jump or move depends on uninitialised value(s)
> ==22263==    at 0x555E8E: __ns_name_skip (in /lib/libresolv-2.3.4.so)
> ==22263==    by 0x54F2DB: __dn_skipname (in /lib/libresolv-2.3.4.so)
> ==22263==    by 0x40166BF: __ns_skiprr (__ns_initparse.c:83)
> ==22263==    by 0x4016839: __ns_initparse (__ns_initparse.c:123)
> ==22263==    by 0x400F3D4: SPF_dns_resolv_lookup (spf_dns_resolv.c:188)
> ==22263==    by 0x400E5E6: SPF_dns_lookup (spf_dns.c:114)
> ==22263==    by 0x4013513: SPF_record_interpret (spf_interpret.c:778)
> ==22263==    by 0x4015289: SPF_request_query_record (spf_request.c:224)
> ==22263==    by 0x401530B: SPF_request_query_mailfrom (spf_request.c:255)
> ==22263==    by 0x8048623: main (main.c:134)
> 
> I'll continue to investigate, and if I come up with a patch, I'll post it.
> 
> 
>