diff options
| author | Simon Kelley <simon@thekelleys.org.uk> | 2014-02-06 12:01:05 +0000 |
|---|---|---|
| committer | Simon Kelley <simon@thekelleys.org.uk> | 2014-02-06 12:01:05 +0000 |
| commit | bb201c211a93b0f7f98974b2654bfd5f3f753d1f (patch) | |
| tree | 681db3129178edb88f8801126c3cbf3ae59935b6 | |
| parent | 12fae49fff5c42675ab4f130edea9e3a6ca73ba6 (diff) | |
| download | dnsmasq-bb201c211a93b0f7f98974b2654bfd5f3f753d1f.tar.gz | |
Protect against malicious DNS replies with very large RRsets.
| -rw-r--r-- | src/dnssec.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/src/dnssec.c b/src/dnssec.c index ff14a80..7a69528 100644 --- a/src/dnssec.c +++ b/src/dnssec.c @@ -531,6 +531,11 @@ static int validate_rrset(time_t now, struct dns_header *header, size_t plen, in { unsigned char **new; + /* Protect against insane/maliciuos queries which bloat the workspace + and eat CPU in the sort */ + if (rrsetidx >= 100) + return STAT_INSECURE; + /* expand */ if (!(new = whine_malloc((rrset_sz + 5) * sizeof(unsigned char **)))) return STAT_INSECURE; |