Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix heap-buffer-overflow issue in function cfg_mark_ports of file util/config_file.c #1040

Merged
merged 1 commit into from
Apr 3, 2024
Merged

fix heap-buffer-overflow issue in function cfg_mark_ports of file util/config_file.c #1040

merged 1 commit into from
Apr 3, 2024

Conversation

xiaoxiaoafeifei
Copy link
Contributor

fix #1039

wcawijngaards
wcawijngaards approved these changes Apr 3, 2024
View reviewed changes
Copy link
Member

@wcawijngaards wcawijngaards left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This fixes the out of bounds access.

@wcawijngaards wcawijngaards merged commit a814fe8 into NLnetLabs:master Apr 3, 2024
1 check passed
wcawijngaards added a commit that referenced this pull request Apr 3, 2024
@wcawijngaards
Changelog note for #1040
103d9a6 
- Fix #1040: fix heap-buffer-overflow issue in function cfg_mark_ports
  of file util/config_file.c.
wcawijngaards added a commit that referenced this pull request Apr 3, 2024
@wcawijngaards
- For #1040: adjust error text and disallow negative ports in other
dfff8d2 
  parts of cfg_mark_ports.
@wcawijngaards
Copy link
Member

The commits adjust the fix to have a different error text, for the user. Also the same check is repeated at the other code path where the port number is parsed and inserted into the array. It then also adds a check so that high numbers are limited to the 65536 array size, to stop it from taking a long time.

Thank you for the fixes! This stops unbound from having trouble with malformed input causing invalid accesses.

jedisct1 added a commit to jedisct1/unbound that referenced this pull request Apr 4, 2024
@jedisct1
Merge remote-tracking branch 'nlnet/master'
b337cdb 
* nlnet/master: (24 commits)
  - Fix NLnetLabs#369: dnstap showing extra responses; for client responses   right from the cache when replying with expired data or   prefetching.
  - Fix NLnetLabs#1035: Potential Bug while parsing port from the "stub-host"   string; also affected forward-zones and remote-control host   directives.
  - For NLnetLabs#1040: adjust error text and disallow negative ports in other   parts of cfg_mark_ports.
  Changelog note for NLnetLabs#1040 - Fix NLnetLabs#1040: fix heap-buffer-overflow issue in function cfg_mark_ports   of file util/config_file.c.
  fix heap-buffer-overflow issue in function cfg_mark_ports of file util/config_file.c
  - Fix for crypto related failures to have a better error string.
  - Fix NLnetLabs#1034: DoT forward-zone via unbound-control.
  - Fix that the server does not chown the pidfile.
  - Fix that when the server truncates the pidfile, it does not follow   symbolic links.
  - Fix to add unit test for lruhash space that exercises the routines.
  - Fix comment in lruhash space function.
  - Fix for NLnetLabs#1032, add safeguard to make table space positive.
  - Fix NLnetLabs#1032: The size of subnet_msg_cache calculation mistake cause   memory usage increased beyond expectations.
  - Fix name of unit test for subnet cache response.
  - For NLnetLabs#831: Format text, use exclamation icon and explicit label   names.
  Changelog entry for NLnetLabs#831 - Merge NLnetLabs#831 from Pierre4012: Improve Windows NSIS installer   script (setup.nsi).
  Improve Windows NSIS installer script (setup.nsi) (NLnetLabs#831)
  - Fix localdata and rpz localdata to match CNAME only if no direct   type match is available.
  - Fix rpz so that rpz CNAME can apply after rpz CNAME. And fix that   clientip and nsip can give a CNAME.
  - Fix rpz for qtype CNAME after nameserver trigger.
  ...
@churchofnoise churchofnoise mentioned this pull request May 8, 2024
Merged
@pemensik
Copy link
Contributor

pemensik commented Oct 4, 2024

This issue were assigned CVE-2024-43168 by Red Hat.

@pemensik
Copy link
Contributor

pemensik commented Oct 4, 2024

Related PR is also #1062.

This was referenced Jan 24, 2025
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
This was referenced Jan 31, 2025
Merged
Merged
Merged
Closed
Merged
This was referenced Feb 11, 2025
Merged
Merged
Merged
Merged
This was referenced Feb 24, 2025
Merged
Merged
Merged
This was referenced Mar 5, 2025
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Draft
Merged
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@wcawijngaards wcawijngaards wcawijngaards approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

a heap-buffer-overflow issue in function cfg_mark_ports of file util/config_file.c
3 participants
@xiaoxiaoafeifei @wcawijngaards @pemensik