possible crash in dns_rdata_tostruct()
In dns_message_parse(), there are a number of exceptions to the usual rules if the message has opcode UDPATE; things that would ordinarily be rejected with FORMERR are passed through. In particular, it's legal for records in the PREREQUISITE or UPDATE sections to have an rdata length of zero.
As a result, it's possible to parse a message off the wire, then call dns_rdata_tostruct() on it, and hit an assertion failure, because several of the tostruct implementations REQUIRE a minimum length.
I encountered this when I ran nsupdate using the server from digdelv/ans7, which returns spurious UPDATE responses.
> update add x.example.com 300 in a 1.2.3.4
do_next_command()
evaluate_update()
update_addordelete()
> send
do_next_command()
start_update()
recvsoa()
About to create rcvmsg
show_message()
Reply from SOA query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id: 49326
;; flags: qr rd; ZONE: 1, PREREQ: 0, UPDATE: 1, ADDITIONAL: 0
;; ZONE SECTION:
;x.example.com. IN SOA
;; UPDATE SECTION:
x.example.com. 0 ANY SOA
Found zone name: x.example.com
rdata/generic/soa_6.c:309: REQUIRE(rdata->length != 0) failed, back trace
/home/each/isc/bind9/lib/isc/.libs/libisc-9.17.13.so(+0x5721c)[0x7ffff7f4921c]
/home/each/isc/bind9/lib/isc/.libs/libisc-9.17.13.so(isc_assertion_failed+0x35)[0x7ffff7f49123]
/home/each/isc/bind9/lib/dns/.libs/libdns-9.17.13.so(+0x120b7a)[0x7ffff7d23b7a]
/home/each/isc/bind9/lib/dns/.libs/libdns-9.17.13.so(dns_rdata_tostruct+0x222)[0x7ffff7d87812]
/home/each/isc/bind9/bin/nsupdate/.libs/nsupdate(+0xd22c)[0x55555556122c]
/home/each/isc/bind9/lib/isc/.libs/libisc-9.17.13.so(+0x9bc73)[0x7ffff7f8dc73]
/home/each/isc/bind9/lib/isc/.libs/libisc-9.17.13.so(isc_task_run+0x1c)[0x7ffff7f8dea7]
/home/each/isc/bind9/lib/isc/.libs/libisc-9.17.13.so(+0x2f234)[0x7ffff7f21234]
/home/each/isc/bind9/lib/isc/.libs/libisc-9.17.13.so(+0x2f4dc)[0x7ffff7f214dc]
/home/each/isc/bind9/lib/isc/.libs/libisc-9.17.13.so(+0x2ffe2)[0x7ffff7f21fe2]
/home/each/isc/bind9/lib/isc/.libs/libisc-9.17.13.so(+0x2f075)[0x7ffff7f21075]
/home/each/isc/bind9/lib/isc/.libs/libisc-9.17.13.so(+0x2f0f8)[0x7ffff7f210f8]
/lib/x86_64-linux-gnu/libuv.so.1(+0xfe08)[0x7ffff7837e08]
/lib/x86_64-linux-gnu/libuv.so.1(uv__io_poll+0x360)[0x7ffff7848ae0]
/lib/x86_64-linux-gnu/libuv.so.1(uv_run+0x11c)[0x7ffff78387ac]
/home/each/isc/bind9/lib/isc/.libs/libisc-9.17.13.so(+0x2ec7c)[0x7ffff7f20c7c]
/home/each/isc/bind9/lib/isc/.libs/libisc-9.17.13.so(isc__trampoline_run+0xd8)[0x7ffff7f9696a]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x9609)[0x7ffff7a54609]
/lib/x86_64-linux-gnu/libc.so.6(clone+0x43)[0x7ffff797b293]
I don't know whether this error is exposed in named, but we need to make sure.
I suspect the right thing to do is go through the tostruct implementations and if there's a REQUIRE about the rdata length, we should change it to return ISC_R_UNEXPECTEDEND instead.