From 4263f395efd136dece52d765dfcff3c96f17506e Mon Sep 17 00:00:00 2001 From: Phil Pennock Date: Wed, 24 Oct 2012 23:26:29 -0400 Subject: SECURITY: DKIM DNS buffer overflow protection CVE-2012-5671 malloc/heap overflow, with a 60kB window of overwrite. Requires DNS under control of person sending email, leaves plenty of evidence, but is very likely exploitable on OSes that have not been well hardened. --- src/src/dkim.c | 3 +++ src/src/pdkim/pdkim.h | 4 ++-- 2 files changed, 5 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/src/dkim.c b/src/src/dkim.c index 87e91dea2..05b5fec56 100644 --- a/src/src/dkim.c +++ b/src/src/dkim.c @@ -42,6 +42,9 @@ int dkim_exim_query_dns_txt(char *name, char *answer) { "%.*s", (int)len, (char *)((rr->data)+rr_offset)); rr_offset+=len; answer_offset+=len; + if (answer_offset >= PDKIM_DNS_TXT_MAX_RECLEN) { + return PDKIM_FAIL; + } } } else return PDKIM_FAIL; diff --git a/src/src/pdkim/pdkim.h b/src/src/pdkim/pdkim.h index 764cc83be..1d364a3c9 100644 --- a/src/src/pdkim/pdkim.h +++ b/src/src/pdkim/pdkim.h @@ -27,8 +27,8 @@ /* -------------------------------------------------------------------------- */ /* Length of the preallocated buffer for the "answer" from the dns/txt - callback function. */ -#define PDKIM_DNS_TXT_MAX_RECLEN 4096 + callback function. This should match the maximum RDLENGTH from DNS. */ +#define PDKIM_DNS_TXT_MAX_RECLEN (1 << 16) /* -------------------------------------------------------------------------- */ /* Function success / error codes */ -- cgit v1.2.3