cuberite/libevent
1
0
Fork 0
mirror of https://github.com/cuberite/libevent.git synced 2025-09-13 14:26:30 -04:00
Code Issues Packages Projects Releases Wiki Activity

evdns: fix searching empty hostnames

Browse Source 
From #332:
  Here follows a bug report by **Guido Vranken** via the _Tor bug bounty program_. Please credit Guido accordingly.

  ## Bug report

  The DNS code of Libevent contains this rather obvious OOB read:

  ```c
  static char *
  search_make_new(const struct search_state *const state, int n, const char *const base_name) {
      const size_t base_len = strlen(base_name);
      const char need_to_append_dot = base_name[base_len - 1] == '.' ? 0 : 1;
  ```

  If the length of ```base_name``` is 0, then line 3125 reads 1 byte before the buffer. This will trigger a crash on ASAN-protected builds.

  To reproduce:

  Build libevent with ASAN:
  ```
  $ CFLAGS='-fomit-frame-pointer -fsanitize=address' ./configure && make -j4
  ```
  Put the attached ```resolv.conf``` and ```poc.c``` in the source directory and then do:

  ```
  $ gcc -fsanitize=address -fomit-frame-pointer poc.c .libs/libevent.a
  $ ./a.out
  =================================================================
  ==22201== ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60060000efdf at pc 0x4429da bp 0x7ffe1ed47300 sp 0x7ffe1ed472f8
  READ of size 1 at 0x60060000efdf thread T0
  ```

P.S. we can add a check earlier, but since this is very uncommon, I didn't add it.

Fixes: #332
This commit is contained in:
Azat Khuzhin 2016-03-25 00:33:47 +03:00
parent d7348bab60
commit ec65c42052
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
evdns.c
View File

@ -3175,9 +3175,12 @@ search_set_from_hostname(struct evdns_base *base) {
static char * static char *
search_make_new(const struct search_state *const state, int n, const char *const base_name) { search_make_new(const struct search_state *const state, int n, const char *const base_name) {
const size_t base_len = strlen(base_name); const size_t base_len = strlen(base_name);
const char need_to_append_dot = base_name[base_len - 1] == '.' ? 0 : 1; char need_to_append_dot;
struct search_domain *dom; struct search_domain *dom;
if (!base_len) return NULL;
need_to_append_dot = base_name[base_len - 1] == '.' ? 0 : 1;
for (dom = state->head; dom; dom = dom->next) { for (dom = state->head; dom; dom = dom->next) {
if (!n--) { if (!n--) {
/* this is the postfix we want */ /* this is the postfix we want */