| From 72842945085cc3adaccfdfa2853771b0e75ef991 Mon Sep 17 00:00:00 2001 |
| From: Evgeny Vereshchagin <evvers@ya.ru> |
| Date: Mon, 23 Oct 2023 20:29:31 +0000 |
| Subject: [PATCH] avahi: core: reject overly long TXT resource records |
| |
| Closes https://github.com/lathiat/avahi/issues/455 |
| |
| Upstream-Status: Backport [https://github.com/lathiat/avahi/commit/a337a1ba7d15853fb56deef1f464529af6e3a1cf] |
| CVE: CVE-2023-38469 |
| |
| Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> |
| --- |
| avahi-core/rr.c | 9 ++++++++- |
| 1 file changed, 8 insertions(+), 1 deletion(-) |
| |
| diff --git a/avahi-core/rr.c b/avahi-core/rr.c |
| index 7fa0bee..b03a24c 100644 |
| --- a/avahi-core/rr.c |
| +++ b/avahi-core/rr.c |
| @@ -32,6 +32,7 @@ |
| #include <avahi-common/malloc.h> |
| #include <avahi-common/defs.h> |
| |
| +#include "dns.h" |
| #include "rr.h" |
| #include "log.h" |
| #include "util.h" |
| @@ -688,11 +689,17 @@ int avahi_record_is_valid(AvahiRecord *r) { |
| case AVAHI_DNS_TYPE_TXT: { |
| |
| AvahiStringList *strlst; |
| + size_t used = 0; |
| |
| - for (strlst = r->data.txt.string_list; strlst; strlst = strlst->next) |
| + for (strlst = r->data.txt.string_list; strlst; strlst = strlst->next) { |
| if (strlst->size > 255 || strlst->size <= 0) |
| return 0; |
| |
| + used += 1+strlst->size; |
| + if (used > AVAHI_DNS_RDATA_MAX) |
| + return 0; |
| + } |
| + |
| return 1; |
| } |
| } |
| -- |
| 2.40.0 |