oss-security - Re: Exploitability of the integer overflows in djbdns 1.05?

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAGUWgD_FATArUVJB=_Exdw0Fs8MQZc2kcZubTUpfbf0_xM=Tag@mail.gmail.com>
Date: Wed, 3 Jun 2020 19:49:00 +0300
From: Georgi Guninski <gguninski@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Exploitability of the integer overflows in djbdns 1.05?

Some potential bugs in djbdns 1.05, I didn't test them
on hardware.

in cdb_make.c:
cdb_make_finish:

    93      memsize = 1;
    94      for (i = 0;i < 256;++i) {
    95        u = c->count[i] * 2;
    96        if (u > memsize)
    97          memsize = u;
    98      }
    99
   100      memsize += c->numentries; /* no overflow possible up to now */
   101      u = (uint32) 0 - (uint32) 1;
   102      u /= sizeof(struct cdb_hp);
   103      if (memsize > u) { errno = error_nomem; return -1; }
   104
   105      c->split = (struct cdb_hp *) alloc(memsize * sizeof(struct cdb_hp));
   106      if (!c->split) return -1;
   107
   108      c->hash = c->split + c->numentries;
   109
   110      u = 0;
   111      for (i = 0;i < 256;++i) {
   112        u += c->count[i]; /* bounded by numentries, so no overflow */
   113        c->start[i] = u;
   114      }

Issue 1:  On line 105 alloc(-SMALL) overflows alloc() despite the check for
overflow (this might be mitigated by memory limits), e.g.
(memsize= (unsigned int) -1 )/sizeof(struct cdb_hp)).

In query.c:

Issue 2:  There are several usages:
   uint16_unpack_big(header + 8,&datalen);
   pos += datalen;

There appears no check if datalen doesn't overflow the buffer,
leading past the end.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.