diff options
author | dougb <dougb@FreeBSD.org> | 2002-11-14 07:28:36 +0000 |
---|---|---|
committer | dougb <dougb@FreeBSD.org> | 2002-11-14 07:28:36 +0000 |
commit | 52e3481daa5eb473969c5ee90e17ba63bb853a30 (patch) | |
tree | a8e36101b8033dea0fb8bf9901abb7eac384c2b9 /dns | |
parent | 982c3a1d061f2e05488ebdfd09935370ba55f669 (diff) | |
download | FreeBSD-ports-52e3481daa5eb473969c5ee90e17ba63bb853a30.zip FreeBSD-ports-52e3481daa5eb473969c5ee90e17ba63bb853a30.tar.gz |
This is the patch provided by ISC, re-generated to work in our system.
Diffstat (limited to 'dns')
-rw-r--r-- | dns/bind8/files/patch-bind833.diff | 234 |
1 files changed, 234 insertions, 0 deletions
diff --git a/dns/bind8/files/patch-bind833.diff b/dns/bind8/files/patch-bind833.diff new file mode 100644 index 0000000..23b32b9 --- /dev/null +++ b/dns/bind8/files/patch-bind833.diff @@ -0,0 +1,234 @@ +diff -ur src-patched/CHANGES src/CHANGES +--- src-patched/CHANGES Wed Jun 26 21:25:08 2002 ++++ src/CHANGES Wed Nov 13 22:11:17 2002 +@@ -1,3 +1,23 @@ ++1469. [bug] buffer length calculation for PX was wrong. ++ ++1468. [bug] ns_name_ntol() could overwite a zero length buffer. ++ ++1467. [bug] off by one bug in ns_makecannon(). ++ ++1466. [bug] large ENDS UDP buffer size could trigger a assertion. ++ ++1465. [bug] possible NULL pointer dereference in db_sec.c ++ ++1464. [bug] the buffer used to construct the -ve record was not ++ big enough for all possible SOA records. use pointer ++ arithmetic to calculate the remaining size in this ++ buffer. ++ ++1463. [bug] use serial space arithmetic to determine if a SIG is ++ too old, in the future or has internally constistant ++ times. ++ ++1462. [bug] write buffer overflow in make_rr(). + + --- 8.3.3-REL released --- (Wed Jun 26 21:15:43 PDT 2002) + +diff -ur src-patched/bin/named/db_defs.h src/bin/named/db_defs.h +--- src-patched/bin/named/db_defs.h Fri May 17 18:02:53 2002 ++++ src/bin/named/db_defs.h Wed Nov 13 22:11:17 2002 +@@ -78,7 +78,7 @@ + */ + + /* max length of data in RR data field */ +-#define MAXDATA (2*MAXDNAME + 5*INT32SZ) ++#define MAXDATA (3*MAXDNAME + 5*INT32SZ) + + /* max length of data in a TXT RR segment */ + #define MAXCHARSTRING 255 +diff -ur src-patched/bin/named/db_sec.c src/bin/named/db_sec.c +--- src-patched/bin/named/db_sec.c Mon Jun 18 07:42:57 2001 ++++ src/bin/named/db_sec.c Wed Nov 13 22:11:17 2002 +@@ -479,7 +479,9 @@ + struct sig_record *sigdata; + struct dnode *sigdn; + struct databuf *sigdp; +- time_t now; ++ u_int32_t now; ++ u_int32_t exptime; ++ u_int32_t signtime; + char *signer; + u_char name_n[MAXDNAME]; + u_char *sig, *eom; +@@ -492,6 +494,7 @@ + int dnssec_failed = 0, dnssec_succeeded = 0; + int return_value; + int i; ++ int expired = 0; + + if (rrset == NULL || rrset->rr_name == NULL) { + ns_warning (ns_log_default, "verify_set: missing rrset/name"); +@@ -527,11 +530,14 @@ + * Don't verify a set if the SIG inception time is in + * the future. This should be fixed before 2038 (BEW) + */ +- if ((time_t)ntohl(sigdata->sig_time_n) > now) ++ signtime = ntohl(sigdata->sig_time_n); ++ if (SEQ_GT(signtime, now)) + continue; + + /* An expired set is dropped, but the data is not. */ +- if ((time_t)ntohl(sigdata->sig_exp_n) < now) { ++ exptime = ntohl(sigdata->sig_exp_n); ++ if (SEQ_GT(now, exptime)) { ++ expired++; + db_detach(&sigdn->dp); + sigdp = NULL; + continue; +@@ -723,7 +729,7 @@ + } + + end: +- if (dnssec_failed > 0) ++ if (dnssec_failed > 0 || expired > 0) + rrset_trim_sigs(rrset); + if (trustedkey == 0 && key != NULL) + dst_free_key(key); +diff -ur src-patched/bin/named/ns_defs.h src/bin/named/ns_defs.h +--- src-patched/bin/named/ns_defs.h Tue Jun 25 20:27:19 2002 ++++ src/bin/named/ns_defs.h Wed Nov 13 22:11:17 2002 +@@ -469,7 +469,7 @@ + q_cmsglen, /* len of cname message */ + q_cmsgsize; /* allocated size of cname message */ + int16_t q_dfd; /* UDP file descriptor */ +- int16_t q_udpsize; /* UDP message size */ ++ u_int16_t q_udpsize; /* UDP message size */ + int q_distance; /* distance this query is from the + * original query that the server + * received. */ +diff -ur src-patched/bin/named/ns_ncache.c src/bin/named/ns_ncache.c +--- src-patched/bin/named/ns_ncache.c Mon Jun 18 07:43:16 2001 ++++ src/bin/named/ns_ncache.c Wed Nov 13 22:11:17 2002 +@@ -66,7 +66,7 @@ + u_int16_t atype; + u_char *sp, *cp1; + u_char data[MAXDATA]; +- size_t len = sizeof data; ++ u_char *eod = data + sizeof(data); + #endif + + nameserIncr(from.sin_addr, nssRcvdNXD); +@@ -186,7 +186,7 @@ + rdatap = cp; + + /* origin */ +- n = dn_expand(msg, msg + msglen, cp, (char*)data, len); ++ n = dn_expand(msg, msg + msglen, cp, (char*)data, eod - data); + if (n < 0) { + ns_debug(ns_log_ncache, 3, + "ncache: origin form error"); +@@ -195,9 +195,8 @@ + cp += n; + n = strlen((char*)data) + 1; + cp1 = data + n; +- len -= n; + /* mail */ +- n = dn_expand(msg, msg + msglen, cp, (char*)cp1, len); ++ n = dn_expand(msg, msg + msglen, cp, (char*)cp1, eod - cp1); + if (n < 0) { + ns_debug(ns_log_ncache, 3, "ncache: mail form error"); + return; +@@ -205,20 +204,20 @@ + cp += n; + n = strlen((char*)cp1) + 1; + cp1 += n; +- len -= n; + n = 5 * INT32SZ; ++ if (n > (eod - cp1)) /* Can't happen. See MAXDATA. */ ++ return; + BOUNDS_CHECK(cp, n); + memcpy(cp1, cp, n); + /* serial, refresh, retry, expire, min */ + cp1 += n; +- len -= n; + cp += n; + if (cp != rdatap + dlen) { + ns_debug(ns_log_ncache, 3, "ncache: form error"); + return; + } + /* store the zone of the soa record */ +- n = dn_expand(msg, msg + msglen, sp, (char*)cp1, len); ++ n = dn_expand(msg, msg + msglen, sp, (char*)cp1, eod - cp1); + if (n < 0) { + ns_debug(ns_log_ncache, 3, "ncache: form error 2"); + return; +diff -ur src-patched/bin/named/ns_req.c src/bin/named/ns_req.c +--- src-patched/bin/named/ns_req.c Sun May 12 16:41:52 2002 ++++ src/bin/named/ns_req.c Wed Nov 13 22:11:17 2002 +@@ -2195,7 +2195,7 @@ + + /* first just copy over the type_covered, algorithm, */ + /* labels, orig ttl, two timestamps, and the footprint */ +- if ((dp->d_size - 18) > buflen) ++ if (buflen < 18) + goto cleanup; /* out of room! */ + memcpy(cp, cp1, 18); + cp += 18; +diff -ur src-patched/bin/named/ns_resp.c src/bin/named/ns_resp.c +--- src-patched/bin/named/ns_resp.c Wed Jun 26 20:09:19 2002 ++++ src/bin/named/ns_resp.c Wed Nov 13 22:11:17 2002 +@@ -2001,7 +2001,7 @@ + * to BOUNDS_CHECK() here. + */ + cp1 += (n = strlen((char *)cp1) + 1); +- n1 = sizeof(data) - n; ++ n1 = sizeof(data) - n - INT16SZ; + n = dn_expand(msg, eom, cp, (char *)cp1, n1); + if (n < 0) { + hp->rcode = FORMERR; +@@ -2043,8 +2043,18 @@ + ttl = origTTL; + } + ++ /* ++ * Check that expire and signature times are internally ++ * consistant. ++ */ ++ if (!SEQ_GT(exptime, signtime) && exptime != signtime) { ++ ns_debug(ns_log_default, 3, ++ "ignoring SIG: signature expires before it was signed"); ++ return ((cp - rrp) + dlen); ++ } ++ + /* Don't let bogus signers "sign" in the future. */ +- if (signtime > now) { ++ if (SEQ_GT(signtime, now)) { + ns_debug(ns_log_default, 3, + "ignoring SIG: signature date %s is in the future", + p_secstodate (signtime)); +@@ -2052,7 +2062,7 @@ + } + + /* Ignore received SIG RR's that are already expired. */ +- if (exptime <= now) { ++ if (SEQ_GT(now, exptime)) { + ns_debug(ns_log_default, 3, + "ignoring SIG: expiration %s is in the past", + p_secstodate (exptime)); +diff -ur src-patched/lib/nameser/ns_name.c src/lib/nameser/ns_name.c +--- src-patched/lib/nameser/ns_name.c Thu May 23 22:10:40 2002 ++++ src/lib/nameser/ns_name.c Wed Nov 13 22:11:17 2002 +@@ -341,6 +341,10 @@ + dn = dst; + eom = dst + dstsiz; + ++ if (dn >= eom) { ++ errno = EMSGSIZE; ++ return (-1); ++ } + while ((n = *cp++) != 0) { + if ((n & NS_CMPRSFLGS) == NS_CMPRSFLGS) { + /* Some kind of compression pointer. */ +diff -ur src-patched/lib/nameser/ns_samedomain.c src/lib/nameser/ns_samedomain.c +--- src-patched/lib/nameser/ns_samedomain.c Fri Oct 15 14:06:51 1999 ++++ src/lib/nameser/ns_samedomain.c Wed Nov 13 22:11:17 2002 +@@ -166,7 +166,7 @@ + ns_makecanon(const char *src, char *dst, size_t dstsize) { + size_t n = strlen(src); + +- if (n + sizeof "." > dstsize) { ++ if (n + sizeof "." + 1 > dstsize) { + errno = EMSGSIZE; + return (-1); + } |