c-ares

212 Commits

14 Branches

97 Tags

23 MiB

Tag: Branch: Tree: b9b8413cfd

Commit Graph

Author	SHA1	Message	Date
Brad House	c9b6c605b5	Validate hostnames in DNS responses and discard from malicious servers (#406 ) To prevent possible users having XSS issues due to intentionally malformed DNS replies, validate hostnames returned in responses and return EBADRESP if they are not valid. It is not clear what legitimate issues this may cause at this point. Bug Reported By: philipp.jeitner@sit.fraunhofer.de Fix By: Brad House (@bradh352)	4 years ago
bradh352	498ce747d3	portability updates for test cases	4 years ago
Fionn Fitzmaurice	6d6cd5daf6	Avoid buffer overflow in RC4 loop comparison (#336 ) The rc4 function iterates over a buffer of size buffer_len who's maximum value is INT_MAX with a counter of type short that is not guaranteed to have maximum size INT_MAX. In circumstances where short is narrower than int and where buffer_len is larger than the maximum value of a short, it may be possible to loop infinitely as counter will overflow and never be greater than or equal to buffer_len. The solution is to make the comparison be between types of equal width. This commit defines counter as an int. Fix By: Fionn Fitzmaurice (@fionn)	5 years ago

Author

SHA1

Message

Date

Brad House

c9b6c605b5

Validate hostnames in DNS responses and discard from malicious servers (#406 )

To prevent possible users having XSS issues due to intentionally malformed DNS replies, validate hostnames returned in responses and return EBADRESP if they are not valid.

It is not clear what legitimate issues this may cause at this point.

Bug Reported By: philipp.jeitner@sit.fraunhofer.de
Fix By: Brad House (@bradh352)

4 years ago

bradh352

498ce747d3

portability updates for test cases

4 years ago

Fionn Fitzmaurice

6d6cd5daf6

Avoid buffer overflow in RC4 loop comparison (#336 )

The rc4 function iterates over a buffer of size buffer_len who's maximum
value is INT_MAX with a counter of type short that is not guaranteed to
have maximum size INT_MAX.

In circumstances where short is narrower than int and where buffer_len
is larger than the maximum value of a short, it may be possible to loop
infinitely as counter will overflow and never be greater than or equal
to buffer_len.

The solution is to make the comparison be between types of equal width.
This commit defines counter as an int.

Fix By: Fionn Fitzmaurice (@fionn)

5 years ago

3 Commits (b9b8413cfdb70a3f99e1573333b23052d57ec1ae)