Re: djbdns misformats some long response packets; patch and example attack

On Wed, Feb 25, 2009 at 2:04 AM, Matthew Dempsky <[email protected]> wrote:
> The DNS protocol restricts name compression to point into the first
> 16384 bytes of a packet.  Line 18 of response.c from djbdns 1.05
> directly references this, but response_addname() in the same file does
> not enforce this at all.  The consequence of this is that names in
> very large DNS packets may be mangled, and clients may misparse the
> packet.

<SNIP>

> --- response.c.orig     2009-02-24 21:04:06.000000000 -0800
> +++ response.c  2009-02-24 21:04:25.000000000 -0800
> @@ -34,7 +34,7 @@
>         uint16_pack_big(buf,49152 + name_ptr[i]);
>         return response_addbytes(buf,2);
>       }
> -    if (dlen <= 128)
> +    if ((dlen <= 128) && (response_len < 16384))
>       if (name_num < NAMES) {
>        byte_copy(name[name_num],dlen,d);
>        name_ptr[name_num] = response_len;

This fix is in zinq-djbdns-0.05, released yesterday.