BUG/MEDIUM: resolvers: reject too long labels when encoding a name

A 256-byte label passed through do-resolve (e.g. from hdr(host)) wraps
its encoded length to zero. Callers using strdup() then truncate the
name but retain its full length, causing out-of-bounds reads and heap
data disclosure in DNS queries. Embedded NULs cause the same issue.

Reject labels longer than DNS_MAX_LABEL_SIZE and embedded NULs in
resolv_str_to_dn_label(), before callers duplicate the encoded name.

This affects do-resolve since its introduction in 2.0 by commit
333939c2e ("MINOR: action: new '(http-request|tcp-request content)
do-resolve' action"). Must be backported to all stable branches.

diff --git a/src/resolvers.c b/src/resolvers.c
index 24f9915f5c0abd905ee4def7e7841bd222483af3..66006b663afb49c89a5f3c6002e3fccef2b7d107 100644 (file)
--- a/src/resolvers.c
+++ b/src/resolvers.c
@@ -1946,6 +1946,13 @@ int resolv_str_to_dn_label(const char *str, int str_len, char *dn, int dn_len)
                        offset = i+1;
                        continue;
                }
+
+               /* labels are limited to 63 chars, and a NUL char would
+                * truncate the name for callers relying on strdup().
+                */
+               if (i - offset >= DNS_MAX_LABEL_SIZE || !str[i])
+                       return -1;
+
                dn[i+1] = tolower((unsigned char)str[i]);
        }
        dn[offset] = i - offset;