diff options
Diffstat (limited to 'sys-apps/systemd/files/233-CVE-2017-9445.patch')
| -rw-r--r-- | sys-apps/systemd/files/233-CVE-2017-9445.patch | 178 |
1 files changed, 178 insertions, 0 deletions
diff --git a/sys-apps/systemd/files/233-CVE-2017-9445.patch b/sys-apps/systemd/files/233-CVE-2017-9445.patch new file mode 100644 index 000000000000..a05c41f47b62 --- /dev/null +++ b/sys-apps/systemd/files/233-CVE-2017-9445.patch @@ -0,0 +1,178 @@ +From 29bb43cc46412366fc939c66331a916de07bfac4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl> +Date: Sun, 18 Jun 2017 16:07:57 -0400 +Subject: [PATCH 1/4] resolved: simplify alloc size calculation + +The allocation size was calculated in a complicated way, and for values +close to the page size we would actually allocate less than requested. + +Reported by Chris Coulson <chris.coulson@canonical.com>. + +CVE-2017-9445 +--- + src/resolve/resolved-dns-packet.c | 8 +------- + src/resolve/resolved-dns-packet.h | 2 -- + 2 files changed, 1 insertion(+), 9 deletions(-) + +diff --git a/src/resolve/resolved-dns-packet.c b/src/resolve/resolved-dns-packet.c +index 652970284..2034e3c8c 100644 +--- a/src/resolve/resolved-dns-packet.c ++++ b/src/resolve/resolved-dns-packet.c +@@ -47,13 +47,7 @@ int dns_packet_new(DnsPacket **ret, DnsProtocol protocol, size_t mtu) { + + assert(ret); + +- if (mtu <= UDP_PACKET_HEADER_SIZE) +- a = DNS_PACKET_SIZE_START; +- else +- a = mtu - UDP_PACKET_HEADER_SIZE; +- +- if (a < DNS_PACKET_HEADER_SIZE) +- a = DNS_PACKET_HEADER_SIZE; ++ a = MAX(mtu, DNS_PACKET_HEADER_SIZE); + + /* round up to next page size */ + a = PAGE_ALIGN(ALIGN(sizeof(DnsPacket)) + a) - ALIGN(sizeof(DnsPacket)); +diff --git a/src/resolve/resolved-dns-packet.h b/src/resolve/resolved-dns-packet.h +index 2c92392e4..3abcaf8cf 100644 +--- a/src/resolve/resolved-dns-packet.h ++++ b/src/resolve/resolved-dns-packet.h +@@ -66,8 +66,6 @@ struct DnsPacketHeader { + /* With EDNS0 we can use larger packets, default to 4096, which is what is commonly used */ + #define DNS_PACKET_UNICAST_SIZE_LARGE_MAX 4096 + +-#define DNS_PACKET_SIZE_START 512 +- + struct DnsPacket { + int n_ref; + DnsProtocol protocol; +-- +2.13.1 + + +From cd3d8a7ebc01cd6913eaa9a591f7d606038a7588 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl> +Date: Tue, 27 Jun 2017 14:20:00 -0400 +Subject: [PATCH 2/4] resolved: do not allocate packets with minimum size + +dns_packet_new() is sometimes called with mtu == 0, and in that case we should +allocate more than the absolute minimum (which is the dns packet header size), +otherwise we have to resize immediately again after appending the first data to +the packet. + +This partially reverts the previous commit. +--- + src/resolve/resolved-dns-packet.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/src/resolve/resolved-dns-packet.c b/src/resolve/resolved-dns-packet.c +index 2034e3c8c..9d806ab33 100644 +--- a/src/resolve/resolved-dns-packet.c ++++ b/src/resolve/resolved-dns-packet.c +@@ -28,6 +28,9 @@ + + #define EDNS0_OPT_DO (1<<15) + ++#define DNS_PACKET_SIZE_START 512 ++assert_cc(DNS_PACKET_SIZE_START > UDP_PACKET_HEADER_SIZE) ++ + typedef struct DnsPacketRewinder { + DnsPacket *packet; + size_t saved_rindex; +@@ -47,7 +50,14 @@ int dns_packet_new(DnsPacket **ret, DnsProtocol protocol, size_t mtu) { + + assert(ret); + +- a = MAX(mtu, DNS_PACKET_HEADER_SIZE); ++ /* When dns_packet_new() is called with mtu == 0, allocate more than the ++ * absolute minimum (which is the dns packet header size), to avoid ++ * resizing immediately again after appending the first data to the packet. ++ */ ++ if (mtu < UDP_PACKET_HEADER_SIZE) ++ a = DNS_PACKET_SIZE_START; ++ else ++ a = MAX(mtu, DNS_PACKET_HEADER_SIZE); + + /* round up to next page size */ + a = PAGE_ALIGN(ALIGN(sizeof(DnsPacket)) + a) - ALIGN(sizeof(DnsPacket)); +-- +2.13.1 + + +From a03fc1acd66d23e239f2545e9a6887c7d0aad7c5 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl> +Date: Tue, 27 Jun 2017 16:59:06 -0400 +Subject: [PATCH 3/4] resolved: define various packet sizes as unsigned + +This seems like the right thing to do, and apparently at least some compilers +warn about signed/unsigned comparisons with DNS_PACKET_SIZE_MAX. +--- + src/resolve/resolved-dns-packet.c | 2 +- + src/resolve/resolved-dns-packet.h | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/src/resolve/resolved-dns-packet.c b/src/resolve/resolved-dns-packet.c +index 9d806ab33..e2285b440 100644 +--- a/src/resolve/resolved-dns-packet.c ++++ b/src/resolve/resolved-dns-packet.c +@@ -28,7 +28,7 @@ + + #define EDNS0_OPT_DO (1<<15) + +-#define DNS_PACKET_SIZE_START 512 ++#define DNS_PACKET_SIZE_START 512u + assert_cc(DNS_PACKET_SIZE_START > UDP_PACKET_HEADER_SIZE) + + typedef struct DnsPacketRewinder { +diff --git a/src/resolve/resolved-dns-packet.h b/src/resolve/resolved-dns-packet.h +index 3abcaf8cf..5dff272fd 100644 +--- a/src/resolve/resolved-dns-packet.h ++++ b/src/resolve/resolved-dns-packet.h +@@ -58,13 +58,13 @@ struct DnsPacketHeader { + /* The various DNS protocols deviate in how large a packet can grow, + but the TCP transport has a 16bit size field, hence that appears to + be the absolute maximum. */ +-#define DNS_PACKET_SIZE_MAX 0xFFFF ++#define DNS_PACKET_SIZE_MAX 0xFFFFu + + /* RFC 1035 say 512 is the maximum, for classic unicast DNS */ +-#define DNS_PACKET_UNICAST_SIZE_MAX 512 ++#define DNS_PACKET_UNICAST_SIZE_MAX 512u + + /* With EDNS0 we can use larger packets, default to 4096, which is what is commonly used */ +-#define DNS_PACKET_UNICAST_SIZE_LARGE_MAX 4096 ++#define DNS_PACKET_UNICAST_SIZE_LARGE_MAX 4096u + + struct DnsPacket { + int n_ref; +-- +2.13.1 + + +From 415871d88e0c44acf8b90dc07245809087a65d2c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl> +Date: Wed, 28 Jun 2017 12:24:37 -0400 +Subject: [PATCH 4/4] resolved: drop unnecessary comparison (#6220) + +mtu is always greater than UDP_PACKET_HEADER_SIZE at this point. +Pointed out by Benjamin Robin. +--- + src/resolve/resolved-dns-packet.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/resolve/resolved-dns-packet.c b/src/resolve/resolved-dns-packet.c +index e2285b440..738d4cc8f 100644 +--- a/src/resolve/resolved-dns-packet.c ++++ b/src/resolve/resolved-dns-packet.c +@@ -57,7 +57,7 @@ int dns_packet_new(DnsPacket **ret, DnsProtocol protocol, size_t mtu) { + if (mtu < UDP_PACKET_HEADER_SIZE) + a = DNS_PACKET_SIZE_START; + else +- a = MAX(mtu, DNS_PACKET_HEADER_SIZE); ++ a = mtu; + + /* round up to next page size */ + a = PAGE_ALIGN(ALIGN(sizeof(DnsPacket)) + a) - ALIGN(sizeof(DnsPacket)); +-- +2.13.1 + |