c-ares

212 Commits

14 Branches

97 Tags

23 MiB

Tag: Branch: Tree: b9b8413cfd

Commit Graph

Author	SHA1	Message	Date
hopper-vul	9903253c34	Add str len check in config_sortlist to avoid stack overflow (#497 ) In ares_set_sortlist, it calls config_sortlist(..., sortstr) to parse the input str and initialize a sortlist configuration. However, ares_set_sortlist has not any checks about the validity of the input str. It is very easy to create an arbitrary length stack overflow with the unchecked `memcpy(ipbuf, str, q-str);` and `memcpy(ipbufpfx, str, q-str);` statements in the config_sortlist call, which could potentially cause severe security impact in practical programs. This commit add necessary check for `ipbuf` and `ipbufpfx` which avoid the potential stack overflows. fixes #496 Fix By: @hopper-vul	2 years ago
Manish Mehra	810c2322f9	Configurable hosts path for file_lookup (#465 ) This changeset adds support for configurable hosts file ARES_OPT_HOSTS_FILE (similar to ARES_OPT_RESOLVCONF). Co-authored-by: Manish Mehra (@mmehra)	3 years ago
Fionn Fitzmaurice	6d6cd5daf6	Avoid buffer overflow in RC4 loop comparison (#336 ) The rc4 function iterates over a buffer of size buffer_len who's maximum value is INT_MAX with a counter of type short that is not guaranteed to have maximum size INT_MAX. In circumstances where short is narrower than int and where buffer_len is larger than the maximum value of a short, it may be possible to loop infinitely as counter will overflow and never be greater than or equal to buffer_len. The solution is to make the comparison be between types of equal width. This commit defines counter as an int. Fix By: Fionn Fitzmaurice (@fionn)	5 years ago

Author

SHA1

Message

Date

hopper-vul

9903253c34

Add str len check in config_sortlist to avoid stack overflow (#497 )

In ares_set_sortlist, it calls config_sortlist(..., sortstr) to parse
the input str and initialize a sortlist configuration.

However, ares_set_sortlist has not any checks about the validity of the input str.
It is very easy to create an arbitrary length stack overflow with the unchecked
`memcpy(ipbuf, str, q-str);` and `memcpy(ipbufpfx, str, q-str);`
statements in the config_sortlist call, which could potentially cause severe
security impact in practical programs.

This commit add necessary check for `ipbuf` and `ipbufpfx` which avoid the
potential stack overflows.

fixes #496

Fix By: @hopper-vul

2 years ago

Manish Mehra

810c2322f9

Configurable hosts path for file_lookup (#465 )

This changeset adds support for configurable hosts file
ARES_OPT_HOSTS_FILE (similar to ARES_OPT_RESOLVCONF).

Co-authored-by: Manish Mehra (@mmehra)

3 years ago

Fionn Fitzmaurice

6d6cd5daf6

Avoid buffer overflow in RC4 loop comparison (#336 )

The rc4 function iterates over a buffer of size buffer_len who's maximum
value is INT_MAX with a counter of type short that is not guaranteed to
have maximum size INT_MAX.

In circumstances where short is narrower than int and where buffer_len
is larger than the maximum value of a short, it may be possible to loop
infinitely as counter will overflow and never be greater than or equal
to buffer_len.

The solution is to make the comparison be between types of equal width.
This commit defines counter as an int.

Fix By: Fionn Fitzmaurice (@fionn)

5 years ago

3 Commits (b9b8413cfdb70a3f99e1573333b23052d57ec1ae)