aboutsummaryrefslogtreecommitdiffstats
path: root/package/network/services/dnsmasq/patches/025-fix-CVE-2017-13704.patch
diff options
context:
space:
mode:
Diffstat (limited to 'package/network/services/dnsmasq/patches/025-fix-CVE-2017-13704.patch')
-rw-r--r--package/network/services/dnsmasq/patches/025-fix-CVE-2017-13704.patch37
1 files changed, 0 insertions, 37 deletions
diff --git a/package/network/services/dnsmasq/patches/025-fix-CVE-2017-13704.patch b/package/network/services/dnsmasq/patches/025-fix-CVE-2017-13704.patch
deleted file mode 100644
index 8848131dac..0000000000
--- a/package/network/services/dnsmasq/patches/025-fix-CVE-2017-13704.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 38af9b1ac3242a4128e88069c495024caa565f0e Mon Sep 17 00:00:00 2001
-From: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
-Date: Tue, 29 Aug 2017 12:35:40 +0100
-Subject: [PATCH] forward.c: fix CVE-2017-13704
-
-Fix SIGSEGV in rfc1035.c answer_request() line 1228 where memset()
-is called with header & limit pointing at the same address and thus
-tries to clear memory from before the buffer begins.
-
-answer_request() is called with an invalid edns packet size provided by
-the client. Ensure the udp_size provided by the client is bounded by
-512 and configured maximum as per RFC 6891 6.2.3 "Values lower than 512
-MUST be treated as equal to 512"
-
-The client that exposed the problem provided a payload udp size of 0.
-
-Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
----
- src/forward.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/src/forward.c b/src/forward.c
-index f22556a..62c5a5a 100644
---- a/src/forward.c
-+++ b/src/forward.c
-@@ -1408,6 +1408,8 @@ void receive_query(struct listener *listen, time_t now)
- defaults to 512 */
- if (udp_size > daemon->edns_pktsz)
- udp_size = daemon->edns_pktsz;
-+ if (udp_size < 512)
-+ udp_size = 512; /* RFC 6891 6.2.3 */
- }
-
- #ifdef HAVE_AUTH
---
-2.7.4
-