1berry/qtbase
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

QDnsLookup/Unix: make sure we don't overflow the buffer

Browse Source 
The DNS Records are variable length and encode their size in 16 bits
before the Record Data (RDATA). Ensure that both the RDATA and the
Record header fields before it fall inside the buffer we have.

Additionally reject any replies containing more than one query records.

[ChangeLog][QtNetwork][QDnsLookup] Fixed a bug that could cause a buffer
overflow in Unix systems while parsing corrupt, malicious, or truncated
replies.

Pick-to: 5.15 6.2 6.5 6.5.1
Change-Id: I3e3bfef633af4130a03afffd175e4b9547654b95
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Jani Heikkinen <jani.heikkinen@qt.io>
This commit is contained in:
Thiago Macieira 2023-05-11 21:40:15 -07:00
parent 0fc0e821f1
commit 7dba2c8761
1 changed files with 25 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
src/network/kernel/qdnslookup_unix.cpp
View File

@ -98,7 +98,6 @@ void QDnsLookupRunnable::query(const int requestType, const QByteArray &requestN
// responseLength in case of error, we still can extract the
// exact error code from the response.
HEADER *header = (HEADER*)response;
const int answerCount = ntohs(header->ancount);
switch (header->rcode) {
case NOERROR:
break;
@ -132,18 +131,31 @@ void QDnsLookupRunnable::query(const int requestType, const QByteArray &requestN
return;
}
// Skip the query host, type (2 bytes) and class (2 bytes).
char host[PACKETSZ], answer[PACKETSZ];
unsigned char *p = response + sizeof(HEADER);
int status = dn_expand(response, response + responseLength, p, host, sizeof(host));
int status;
if (ntohs(header->qdcount) == 1) {
// Skip the query host, type (2 bytes) and class (2 bytes).
status = dn_expand(response, response + responseLength, p, host, sizeof(host));
if (status < 0) {
reply->error = QDnsLookup::InvalidReplyError;
reply->errorString = tr("Could not expand domain name");
return;
}
if ((p - response) + status + 4 >= responseLength)
header->qdcount = 0xffff; // invalid reply below
else
p += status + 4;
}
if (ntohs(header->qdcount) > 1) {
reply->error = QDnsLookup::InvalidReplyError;
reply->errorString = tr("Invalid reply received");
return;
}
// Extract results.
const int answerCount = ntohs(header->ancount);
int answerIndex = 0;
while ((p < response + responseLength) && (answerIndex < answerCount)) {
status = dn_expand(response, response + responseLength, p, host, sizeof(host));
@ -155,6 +167,11 @@ void QDnsLookupRunnable::query(const int requestType, const QByteArray &requestN
const QString name = QUrl::fromAce(host);
p += status;
if ((p - response) + 10 > responseLength) {
// probably just a truncated reply, return what we have
return;
}
const quint16 type = (p[0] << 8) | p[1];
p += 2; // RR type
p += 2; // RR class
@ -162,6 +179,8 @@ void QDnsLookupRunnable::query(const int requestType, const QByteArray &requestN
p += 4;
const quint16 size = (p[0] << 8) | p[1];
p += 2;
if ((p - response) + size > responseLength)
return; // truncated
if (type == QDnsLookup::A) {
if (size != 4) {