Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Validate option_len in EDNS packets.

Browse source
This commit is contained in:
ronwellman 2020-07-24 09:26:09 -04:00
parent b17ec6bf93
commit 19e91292e8
1 changed files with 12 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

15
src/analyzer/protocol/dns/DNS.cc
View file

@ -712,7 +712,11 @@ bool DNS_Interpreter::ParseRR_EDNS(DNS_MsgInfo* msg,
while ( len > 0 ) while ( len > 0 )
{ {
uint16_t option_code = ExtractShort(data, len); uint16_t option_code = ExtractShort(data, len);
int option_len = ExtractShort(data, len); uint16_t option_len = ExtractShort(data, len);
// check for invalid option length
if ( (option_len > len) || (0 == option_len) ) {
break;
}
len -= option_len; len -= option_len;
// TODO: Implement additional option codes // TODO: Implement additional option codes
@ -720,9 +724,14 @@ bool DNS_Interpreter::ParseRR_EDNS(DNS_MsgInfo* msg,
{ {
case TYPE_ECS: case TYPE_ECS:
{ {
// must be 4 bytes + variable number of octets for address
if ( option_len <= 4 ) {
break;
}
EDNS_ECS opt{}; EDNS_ECS opt{};
uint16_t ecs_family = ExtractShort(data, option_len); uint16_t ecs_family = ExtractShort(data, (int&)option_len);
uint16_t source_scope = ExtractShort(data, option_len); uint16_t source_scope = ExtractShort(data, (int&)option_len);
opt.ecs_src_pfx_len = (source_scope >> 8) & 0xff; opt.ecs_src_pfx_len = (source_scope >> 8) & 0xff;
opt.ecs_scp_pfx_len = source_scope & 0xff; opt.ecs_scp_pfx_len = source_scope & 0xff;