Skip to content
GitLab
Projects Groups Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Register
  • Sign in
  • BIND BIND
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 605
    • Issues 605
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 86
    • Merge requests 86
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages and registries
    • Packages and registries
    • Container Registry
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • ISC Open Source ProjectsISC Open Source Projects
  • BINDBIND
  • Issues
  • #2762
Closed
Open
Issue created Jun 09, 2021 by Evan Hunt@eachDeveloper

possible crash in dns_rdata_tostruct()

In dns_message_parse(), there are a number of exceptions to the usual rules if the message has opcode UDPATE; things that would ordinarily be rejected with FORMERR are passed through. In particular, it's legal for records in the PREREQUISITE or UPDATE sections to have an rdata length of zero.

As a result, it's possible to parse a message off the wire, then call dns_rdata_tostruct() on it, and hit an assertion failure, because several of the tostruct implementations REQUIRE a minimum length.

I encountered this when I ran nsupdate using the server from digdelv/ans7, which returns spurious UPDATE responses.

> update add x.example.com 300 in a 1.2.3.4
do_next_command()
evaluate_update()
update_addordelete()
> send
do_next_command()
start_update()
recvsoa()
About to create rcvmsg
show_message()
Reply from SOA query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:  49326
;; flags: qr rd; ZONE: 1, PREREQ: 0, UPDATE: 1, ADDITIONAL: 0
;; ZONE SECTION:
;x.example.com.	IN	SOA

;; UPDATE SECTION:
x.example.com. 0	ANY	SOA	

Found zone name: x.example.com
rdata/generic/soa_6.c:309: REQUIRE(rdata->length != 0) failed, back trace
/home/each/isc/bind9/lib/isc/.libs/libisc-9.17.13.so(+0x5721c)[0x7ffff7f4921c]
/home/each/isc/bind9/lib/isc/.libs/libisc-9.17.13.so(isc_assertion_failed+0x35)[0x7ffff7f49123]
/home/each/isc/bind9/lib/dns/.libs/libdns-9.17.13.so(+0x120b7a)[0x7ffff7d23b7a]
/home/each/isc/bind9/lib/dns/.libs/libdns-9.17.13.so(dns_rdata_tostruct+0x222)[0x7ffff7d87812]
/home/each/isc/bind9/bin/nsupdate/.libs/nsupdate(+0xd22c)[0x55555556122c]
/home/each/isc/bind9/lib/isc/.libs/libisc-9.17.13.so(+0x9bc73)[0x7ffff7f8dc73]
/home/each/isc/bind9/lib/isc/.libs/libisc-9.17.13.so(isc_task_run+0x1c)[0x7ffff7f8dea7]
/home/each/isc/bind9/lib/isc/.libs/libisc-9.17.13.so(+0x2f234)[0x7ffff7f21234]
/home/each/isc/bind9/lib/isc/.libs/libisc-9.17.13.so(+0x2f4dc)[0x7ffff7f214dc]
/home/each/isc/bind9/lib/isc/.libs/libisc-9.17.13.so(+0x2ffe2)[0x7ffff7f21fe2]
/home/each/isc/bind9/lib/isc/.libs/libisc-9.17.13.so(+0x2f075)[0x7ffff7f21075]
/home/each/isc/bind9/lib/isc/.libs/libisc-9.17.13.so(+0x2f0f8)[0x7ffff7f210f8]
/lib/x86_64-linux-gnu/libuv.so.1(+0xfe08)[0x7ffff7837e08]
/lib/x86_64-linux-gnu/libuv.so.1(uv__io_poll+0x360)[0x7ffff7848ae0]
/lib/x86_64-linux-gnu/libuv.so.1(uv_run+0x11c)[0x7ffff78387ac]
/home/each/isc/bind9/lib/isc/.libs/libisc-9.17.13.so(+0x2ec7c)[0x7ffff7f20c7c]
/home/each/isc/bind9/lib/isc/.libs/libisc-9.17.13.so(isc__trampoline_run+0xd8)[0x7ffff7f9696a]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x9609)[0x7ffff7a54609]
/lib/x86_64-linux-gnu/libc.so.6(clone+0x43)[0x7ffff797b293]

I don't know whether this error is exposed in named, but we need to make sure.

I suspect the right thing to do is go through the tostruct implementations and if there's a REQUIRE about the rdata length, we should change it to return ISC_R_UNEXPECTEDEND instead.

Edited Jun 09, 2021 by Evan Hunt
Assignee
Assign to
Time tracking