diff options
author | tmarkwalder <tmark@isc.org> | 2017-05-03 08:54:18 -0400 |
---|---|---|
committer | tmarkwalder <tmark@isc.org> | 2017-05-03 08:54:18 -0400 |
commit | c30a10f77eafffdf6e42113b2dd566d47fec920a (patch) | |
tree | c3f01ec8d6de8c25b39595f4b11dd9b5af65cc10 | |
parent | 7ff65f8e1a7850731cb3517beb4dbb98f6608939 (diff) | |
download | isc-dhcp-c30a10f77eafffdf6e42113b2dd566d47fec920a.tar.gz |
[v4_3] v6 FQDN option unpacking now handles values with spaces and non-printables
Merged in rt43592.
-rw-r--r-- | RELNOTES | 7 | ||||
-rw-r--r-- | common/options.c | 20 |
2 files changed, 19 insertions, 8 deletions
@@ -107,6 +107,13 @@ by Eric Young (eay@cryptsoft.com). reporting the issue. [ISC-Bugs #28038] +- DHCP6 FQDN option unpacking code now correctly handles values that contain + spaces, special, or non-printable characters. Prior to this the buffer + size needed was underestitmate causing a conversion error message to + be logged and DNS updates to be skipped. Thanks to Fernando Soto at + BlueCat Networks for bringing the matter to our attention. + [ISC-Bugs #43592] + Changes since 4.3.5b1 - Corrected a bug which could cause the server to sporadically crash while diff --git a/common/options.c b/common/options.c index b41ec4d4..f6e5a203 100644 --- a/common/options.c +++ b/common/options.c @@ -3590,12 +3590,17 @@ fqdn6_universe_decode(struct option_state *options, return 0; /* Save the contents of the option in a buffer. There are 3 - * one-byte values we record from the packet, so we go ahead - * and allocate a bigger buffer to accommodate them. But the - * 'length' we got (because it is a DNS encoded string) is - * one longer than we need...so we only add two extra octets. - */ - if (!buffer_allocate(&bp, length + 2, MDL)) { + * one-byte values we record from the packet. The input is + * DNS encoded and to be safe we'll assume that each character + * is non-printable and will be converted to an escaped number: + * "\\nnn". Yes, we'll have dead space pretty much all the time + * but the alternative is to basically dry run the conversion + * first to calculate the precise size or reallocate to a smaller + * buffer later, either of which is a bigger performance hit than + * just doing a generous allocation. */ + unsigned bp_size = 3 + (length * 4); + + if (!buffer_allocate(&bp, bp_size, MDL)) { log_error("No memory for dhcp6.fqdn option buffer."); return 0; } @@ -3607,7 +3612,6 @@ fqdn6_universe_decode(struct option_state *options, goto error; /* XXX: We need to process 'The "N" bit'. */ - if (buffer[0] & 1) /* server-update. */ bp->data[2] = 1; else @@ -3627,7 +3631,7 @@ fqdn6_universe_decode(struct option_state *options, goto error; /* Convert the domain name to textual representation for config. */ - len = MRns_name_ntop(buffer + 1, (char *)bp->data + 3, length - 1); + len = MRns_name_ntop(buffer + 1, (char *)bp->data + 3, bp_size - 3); if (len == -1) { log_error("Unable to convert dhcp6.fqdn domain name to " "printable form."); |