Skip to content

Commit ec65c42

Browse files
committed
evdns: fix searching empty hostnames
From #332: Here follows a bug report by **Guido Vranken** via the _Tor bug bounty program_. Please credit Guido accordingly. ## Bug report The DNS code of Libevent contains this rather obvious OOB read: ```c static char * search_make_new(const struct search_state *const state, int n, const char *const base_name) { const size_t base_len = strlen(base_name); const char need_to_append_dot = base_name[base_len - 1] == '.' ? 0 : 1; ``` If the length of ```base_name``` is 0, then line 3125 reads 1 byte before the buffer. This will trigger a crash on ASAN-protected builds. To reproduce: Build libevent with ASAN: ``` $ CFLAGS='-fomit-frame-pointer -fsanitize=address' ./configure && make -j4 ``` Put the attached ```resolv.conf``` and ```poc.c``` in the source directory and then do: ``` $ gcc -fsanitize=address -fomit-frame-pointer poc.c .libs/libevent.a $ ./a.out ================================================================= ==22201== ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60060000efdf at pc 0x4429da bp 0x7ffe1ed47300 sp 0x7ffe1ed472f8 READ of size 1 at 0x60060000efdf thread T0 ``` P.S. we can add a check earlier, but since this is very uncommon, I didn't add it. Fixes: #332
1 parent d7348ba commit ec65c42

File tree

1 file changed

+4
-1
lines changed

1 file changed

+4
-1
lines changed

Diff for: evdns.c

+4-1
Original file line numberDiff line numberDiff line change
@@ -3175,9 +3175,12 @@ search_set_from_hostname(struct evdns_base *base) {
31753175
static char *
31763176
search_make_new(const struct search_state *const state, int n, const char *const base_name) {
31773177
const size_t base_len = strlen(base_name);
3178-
const char need_to_append_dot = base_name[base_len - 1] == '.' ? 0 : 1;
3178+
char need_to_append_dot;
31793179
struct search_domain *dom;
31803180

3181+
if (!base_len) return NULL;
3182+
need_to_append_dot = base_name[base_len - 1] == '.' ? 0 : 1;
3183+
31813184
for (dom = state->head; dom; dom = dom->next) {
31823185
if (!n--) {
31833186
/* this is the postfix we want */

0 commit comments

Comments
 (0)