diff options
| author | Phil Pennock <pdp@exim.org> | 2012-10-24 23:26:29 -0400 |
|---|---|---|
| committer | Phil Pennock <pdp@exim.org> | 2012-10-24 23:26:29 -0400 |
| commit | 4263f395efd136dece52d765dfcff3c96f17506e (patch) | |
| tree | 867adc4c09b196ed44a7a334025b09c36501b0b9 /src | |
| parent | bba74fc65f77dc6678b3d33eef0acf43efe8f653 (diff) | |
SECURITY: DKIM DNS buffer overflow protection
CVE-2012-5671
malloc/heap overflow, with a 60kB window of overwrite.
Requires DNS under control of person sending email, leaves plenty of
evidence, but is very likely exploitable on OSes that have not been
well hardened.
Diffstat (limited to 'src')
| -rw-r--r-- | src/src/dkim.c | 3 | ||||
| -rw-r--r-- | src/src/pdkim/pdkim.h | 4 |
2 files changed, 5 insertions, 2 deletions
diff --git a/src/src/dkim.c b/src/src/dkim.c index 87e91dea2..05b5fec56 100644 --- a/src/src/dkim.c +++ b/src/src/dkim.c @@ -42,6 +42,9 @@ int dkim_exim_query_dns_txt(char *name, char *answer) { "%.*s", (int)len, (char *)((rr->data)+rr_offset)); rr_offset+=len; answer_offset+=len; + if (answer_offset >= PDKIM_DNS_TXT_MAX_RECLEN) { + return PDKIM_FAIL; + } } } else return PDKIM_FAIL; diff --git a/src/src/pdkim/pdkim.h b/src/src/pdkim/pdkim.h index 764cc83be..1d364a3c9 100644 --- a/src/src/pdkim/pdkim.h +++ b/src/src/pdkim/pdkim.h @@ -27,8 +27,8 @@ /* -------------------------------------------------------------------------- */ /* Length of the preallocated buffer for the "answer" from the dns/txt - callback function. */ -#define PDKIM_DNS_TXT_MAX_RECLEN 4096 + callback function. This should match the maximum RDLENGTH from DNS. */ +#define PDKIM_DNS_TXT_MAX_RECLEN (1 << 16) /* -------------------------------------------------------------------------- */ /* Function success / error codes */ |