[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <YQbnc3DxV6iEaA3B@sol.nexus.lan>
Date: Sun, 1 Aug 2021 18:31:27 +0000
From: John Helmert III <jchelmert3@...teo.net>
To: oss-security@...ts.openwall.com
Subject: Re: Polipo: denial-of-service using range
How did you produce this? I can't seem to reproduce with the original
PoC script. Running it, polipo outputs:
Empty DNS name.
Host (unknown) lookup failed: empty name (22).
The script outputs:
HTTP/1.1 504 Host (unknown) lookup failed: empty name
Connection: keep-alive
Date: Sun, 01 Aug 2021 18:07:07 GMT
Content-Type: text/html
Content-Length: 515
Expires: 0
Cache-Control: no-cache
Pragma: no-cache
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html><head>
<title>Proxy error: 504 Host (unknown) lookup failed: empty name.</title>
</head><body>
<h1>504 Host (unknown) lookup failed: empty name</h1>
<p>The following error occurred while trying to access <strong>http://</strong>:<br><br>
<strong>504 Host (unknown) lookup failed: empty name</strong></p>
<hr>Generated Sun, 01 Aug 2021 13:07:07 CDT by Polipo on <em>localhost:8123</em>.
</body></html>
Fixing the script to GET a real website shows a bunch of memory alignment
issues, but no heap overflow as far as I can tell:
dns.c:1467:5: runtime error: store to misaligned address 0x7ffe1de13c69 for type 'short unsigned int', which requires 2 byte alignment
0x7ffe1de13c69: note: pointer points here
63 6f 6d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^
dns.c:1468:5: runtime error: store to misaligned address 0x7ffe1de13c6b for type 'short unsigned int', which requires 2 byte alignment
0x7ffe1de13c6b: note: pointer points here
6d 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^
dns.c:1554:5: runtime error: load of misaligned address 0x7ffe1de13b69 for type 'short unsigned int', which requires 2 byte alignment
0x7ffe1de13b69: note: pointer points here
63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 fe a7 00 04 5d b8 d8 22 7f 00 00 50 3c e1 1d fe
^
dns.c:1555:5: runtime error: load of misaligned address 0x7ffe1de13b6b for type 'short unsigned int', which requires 2 byte alignment
0x7ffe1de13b6b: note: pointer points here
6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 fe a7 00 04 5d b8 d8 22 7f 00 00 50 3c e1 1d fe 7f 00
^
dns.c:1596:9: runtime error: load of misaligned address 0x7ffe1de13b6f for type 'short unsigned int', which requires 2 byte alignment
0x7ffe1de13b6f: note: pointer points here
00 01 c0 0c 00 01 00 01 00 00 fe a7 00 04 5d b8 d8 22 7f 00 00 50 3c e1 1d fe 7f 00 00 22 3d 00
^
dns.c:1596:9: runtime error: load of misaligned address 0x7ffe1de13b71 for type 'short unsigned int', which requires 2 byte alignment
0x7ffe1de13b71: note: pointer points here
c0 0c 00 01 00 01 00 00 fe a7 00 04 5d b8 d8 22 7f 00 00 50 3c e1 1d fe 7f 00 00 22 3d 00 00 40
^
dns.c:1596:9: runtime error: load of misaligned address 0x7ffe1de13b73 for type 'unsigned int', which requires 4 byte alignment
0x7ffe1de13b73: note: pointer points here
00 01 00 01 00 00 fe a7 00 04 5d b8 d8 22 7f 00 00 50 3c e1 1d fe 7f 00 00 22 3d 00 00 40 60 00
^
dns.c:1596:9: runtime error: load of misaligned address 0x7ffe1de13b77 for type 'short unsigned int', which requires 2 byte alignment
0x7ffe1de13b77: note: pointer points here
00 00 fe a7 00 04 5d b8 d8 22 7f 00 00 50 3c e1 1d fe 7f 00 00 22 3d 00 00 40 60 00 00 6b 3c e1
^
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
