Attachment 624300 Details for Bug 864273 – diff of bind-9.6-ESV-R7-P3 to P4

[patch] diff of bind-9.6-ESV-R7-P3 to P4

bind-9.6-ESV-R7-P4-CVE-2012-5166.patch (text/plain), 3.74 KB, created by Vincent Danen on 2012-10-09 22:44:52 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Vincent Danen

Created: 2012-10-09 22:44:52 UTC

Size: 3.74 KB

patch

obsolete

>diff -pruN bind-9.6-ESV-R7-P3/CHANGES bind-9.6-ESV-R7-P4/CHANGES
>--- bind-9.6-ESV-R7-P3/CHANGES	2012-08-23 22:34:54.000000000 -0600
>+++ bind-9.6-ESV-R7-P4/CHANGES	2012-09-26 18:50:08.000000000 -0600
>@@ -1,3 +1,9 @@
>+	--- 9.6-ESV-R7-P4 released ---
>+
>+3383.	[security]	A certain combination of records in the RBT could
>+                        cause named to hang while populating the additional
>+                        section of a response. [RT #31090]
>+
> 	--- 9.6-ESV-R7-P3 released ---
> 
> 3364.	[security]	Named could die on specially crafted record.
>diff -pruN bind-9.6-ESV-R7-P3/bin/named/query.c bind-9.6-ESV-R7-P4/bin/named/query.c
>--- bind-9.6-ESV-R7-P3/bin/named/query.c	2012-08-23 22:34:54.000000000 -0600
>+++ bind-9.6-ESV-R7-P4/bin/named/query.c	2012-09-26 18:50:08.000000000 -0600
>@@ -1025,13 +1025,6 @@ query_isduplicate(ns_client_t *client, d
> 		mname = NULL;
> 	}
> 
>-	/*
>-	 * If the dns_name_t we're looking up is already in the message,
>-	 * we don't want to trigger the caller's name replacement logic.
>-	 */
>-	if (name == mname)
>-		mname = NULL;
>-
> 	if (mnamep != NULL)
> 		*mnamep = mname;
> 
>@@ -1230,6 +1223,7 @@ query_addadditional(void *arg, dns_name_
> 	if (dns_rdataset_isassociated(rdataset) &&
> 	    !query_isduplicate(client, fname, type, &mname)) {
> 		if (mname != NULL) {
>+			INSIST(mname != fname);
> 			query_releasename(client, &fname);
> 			fname = mname;
> 		} else
>@@ -1292,11 +1286,13 @@ query_addadditional(void *arg, dns_name_
> 			mname = NULL;
> 			if (!query_isduplicate(client, fname,
> 					       dns_rdatatype_a, &mname)) {
>-				if (mname != NULL) {
>-					query_releasename(client, &fname);
>-					fname = mname;
>-				} else
>-					need_addname = ISC_TRUE;
>+				if (mname != fname) {
>+					if (mname != NULL) {
>+						query_releasename(client, &fname);
>+						fname = mname;
>+					} else
>+						need_addname = ISC_TRUE;
>+				}
> 				ISC_LIST_APPEND(fname->list, rdataset, link);
> 				added_something = ISC_TRUE;
> 				if (sigrdataset != NULL &&
>@@ -1338,11 +1334,13 @@ query_addadditional(void *arg, dns_name_
> 			mname = NULL;
> 			if (!query_isduplicate(client, fname,
> 					       dns_rdatatype_aaaa, &mname)) {
>-				if (mname != NULL) {
>-					query_releasename(client, &fname);
>-					fname = mname;
>-				} else
>-					need_addname = ISC_TRUE;
>+				if (mname != fname) {
>+					if (mname != NULL) {
>+						query_releasename(client, &fname);
>+						fname = mname;
>+					} else
>+						need_addname = ISC_TRUE;
>+				}
> 				ISC_LIST_APPEND(fname->list, rdataset, link);
> 				added_something = ISC_TRUE;
> 				if (sigrdataset != NULL &&
>@@ -1865,22 +1863,24 @@ query_addadditional2(void *arg, dns_name
> 		    crdataset->type == dns_rdatatype_aaaa) {
> 			if (!query_isduplicate(client, fname, crdataset->type,
> 					       &mname)) {
>-				if (mname != NULL) {
>-					/*
>-					 * A different type of this name is
>-					 * already stored in the additional
>-					 * section.  We'll reuse the name.
>-					 * Note that this should happen at most
>-					 * once.  Otherwise, fname->link could
>-					 * leak below.
>-					 */
>-					INSIST(mname0 == NULL);
>-
>-					query_releasename(client, &fname);
>-					fname = mname;
>-					mname0 = mname;
>-				} else
>-					need_addname = ISC_TRUE;
>+				if (mname != fname) {
>+					if (mname != NULL) {
>+						/*
>+						 * A different type of this name is
>+						 * already stored in the additional
>+						 * section.  We'll reuse the name.
>+						 * Note that this should happen at most
>+						 * once.  Otherwise, fname->link could
>+						 * leak below.
>+						 */
>+						INSIST(mname0 == NULL);
>+
>+						query_releasename(client, &fname);
>+						fname = mname;
>+						mname0 = mname;
>+					} else
>+						need_addname = ISC_TRUE;
>+				}
> 				ISC_LIST_UNLINK(cfname.list, crdataset, link);
> 				ISC_LIST_APPEND(fname->list, crdataset, link);
> 				added_something = ISC_TRUE;

Actions: View | Diff

Attachments on bug 864273: 624300