From a006b48c04543947e1e924972a9026824bdc3d29 Mon Sep 17 00:00:00 2001 From: Kevin Darbyshire-Bryant Date: Tue, 29 Aug 2017 14:29:18 +0100 Subject: dnsmasq: forward.c: fix CVE-2017-13704 Fix SIGSEGV in rfc1035.c answer_request() line 1228 where memset() is called with header & limit pointing at the same address and thus tries to clear memory from before the buffer begins. answer_request() is called with an invalid edns packet size provided by the client. Ensure the udp_size provided by the client is bounded by 512 and configured maximum as per RFC 6891 6.2.3 "Values lower than 512 MUST be treated as equal to 512" The client that exposed the problem provided a payload udp size of 0. Signed-off-by: Kevin Darbyshire-Bryant Acked-by: Hans Dedecker --- package/network/services/dnsmasq/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'package/network/services/dnsmasq/Makefile') diff --git a/package/network/services/dnsmasq/Makefile b/package/network/services/dnsmasq/Makefile index a169edba62..dda11dbfed 100644 --- a/package/network/services/dnsmasq/Makefile +++ b/package/network/services/dnsmasq/Makefile @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=dnsmasq PKG_VERSION:=2.77 -PKG_RELEASE:=3 +PKG_RELEASE:=4 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz PKG_SOURCE_URL:=http://thekelleys.org.uk/dnsmasq/ -- cgit v1.2.3