Ticket History #1216: bounds check res_search return value

From nalin@blade.devel.redhat.com Wed Oct 9 16:23:04 2002
Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.7.21.83]) by krbdev.mit.edu (8.9.3) with ESMTP
id QAA24755; Wed, 9 Oct 2002 16:23:04 -0400 (EDT)
Received: from blade.devel.redhat.com (nat-pool-rdu.redhat.com [66.187.233.200])
by pacific-carrier-annex.mit.edu (8.9.2/8.9.2) with ESMTP id QAA28578
for <krb5-bugs@mit.edu>; Wed, 9 Oct 2002 16:23:03 -0400 (EDT)
Received: from blade.devel.redhat.com (localhost.localdomain [127.0.0.1])
by blade.devel.redhat.com (8.12.5/8.12.5) with ESMTP id g99KN9TG027961
for <krb5-bugs@mit.edu>; Wed, 9 Oct 2002 16:23:09 -0400
Received: (from nalin@localhost)
by blade.devel.redhat.com (8.12.5/8.12.5/Submit) id g99KN9ap027959;
Wed, 9 Oct 2002 16:23:09 -0400
Date: Wed, 9 Oct 2002 16:23:09 -0400
Message-Id: <200210092023.g99KN9ap027959@blade.devel.redhat.com>
To: krb5-bugs@mit.edu
From: nalin@redhat.com
Reply-To: nalin@redhat.com
X-send-pr-version: 3.99
System: Linux 2.4.18
Architecture: i686

glibc 2.2.x/2.3

The res_search() function is allowed to return a result size
which is larger than the size of the buffer which is passed in
by the calling application (in this case, libkrb5) if the response
has to be truncated to fit into the buffer. libkrb5 does not
check for this.
Configure a Kerberos client to use DNS to retrieve server
information for the local realm, and populate DNS with a large,
unique RRs for the queries libkrb5 will make.
A longer patch could retry a truncated request with a larger
buffer, but the simplest thing is to fail for too-large responses,
which is what should happen anyway if the library attempts to read
past the end of its buffer. This patch hasn't been thorougly
tested, but it looks correct:

--- src/lib/krb5/os/hst_realm.c 2002-10-09 14:03:04.000000000 -0400
+++ src/lib/krb5/os/hst_realm.c 2002-10-09 14:12:43.000000000 -0400
@@ -141,7 +141,7 @@
}
size = res_search(host, C_IN, T_TXT, answer.bytes, sizeof(answer.bytes));

- if (size < 0)
+ if ((size < sizeof(HEADER)) || (size > sizeof(answer.bytes))
return KRB5_ERR_HOST_REALM_UNKNOWN;

p = answer.bytes;
--- src/lib/krb5/os/locate_kdc.c 2002-10-09 14:15:57.000000000 -0400
+++ src/lib/krb5/os/locate_kdc.c 2002-10-09 14:59:26.000000000 -0400
@@ -391,7 +391,7 @@

size = res_search(host, C_IN, T_SRV, answer.bytes, sizeof(answer.bytes));

- if (size < hdrsize)
+ if ((size < hdrsize) || (size > sizeof(answer.bytes))
goto out;

/*
@@ -463,6 +463,8 @@
CHECK(p,2);
rdlen = NTOHSP(p,2);

+ CHECK(p,rdlen);
+
/*
* If this is an SRV record, process it. Record format is:
*

On Thu, Oct 10, 2002 at 07:27:21PM -0400, Tom Yu via RT wrote:
[snip]

Oh, you're right. I was trying to guard against missing data for other
RR types, but there's an else block around line 520 that already does
the job.

Thanks,

Nalin