Re: squeeze update of dnsmasq?

[Santiago Ruano Rincón]

Hi Simon,

On Thu, May 14, 2015 at 09:57:24PM +0100, Simon Kelley wrote:
> Hi Raphael.
> 
> I'm over-committed trying to get the long-overdue 2.73 release of
> dnsmasq out at the moment, so if the LTS team could handle the Debian
> mechanics of this, that would really  help me.
> 

In that case, I can take care of it.

> I can confirm that the patch which fixes the issue is here
> 
> http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=blobdiff;f=src/rfc1035.c;h=a995ab50d74adde068c8839684f9b3a44f4976d0;hp=7a07b0cee90655e296f57fa79f4d4a3a409b7b89;hb=ad4a8ff7d9097008d7623df8543df435bfddeac8;hpb=04b0ac05377936d121a36873bb63d492cde292c9
> 
> 
> The are three hunks in that patch, and hunks 1 and 3 apply to 2.55. (the
> version in squeeze) Hunk 2 is rejected by patch: this can be ignored, it
> simply removes a check which is now done more completely at the start of
> the function.
> 

I'm attaching the clean patch to fix CVE-2015-3294.

Regards,

Santiago


diff --git a/src/rfc1035.c b/src/rfc1035.c
index 3289bf3..2a376f3 100644
--- a/src/rfc1035.c
+++ b/src/rfc1035.c
@@ -939,7 +939,10 @@ unsigned short extract_request(HEADER *header, size_t qlen, char *name, unsigned
 size_t setup_reply(HEADER *header, size_t qlen,
 		struct all_addr *addrp, unsigned short flags, unsigned long ttl)
 {
-  unsigned char *p = skip_questions(header, qlen);
+  unsigned char *p;
+
+  if (!(p = skip_questions(header, qlen)))
+    return 0;
   
   header->qr = 1; /* response */
   header->aa = 0; /* authoritive */
@@ -954,7 +957,7 @@ size_t setup_reply(HEADER *header, size_t qlen,
     header->rcode = NOERROR; /* empty domain */
   else if (flags == F_NXDOMAIN)
     header->rcode = NXDOMAIN;
-  else if (p && flags == F_IPV4)
+  else if (flags == F_IPV4)
     { /* we know the address */
       header->rcode = NOERROR;
       header->ancount = htons(1);
@@ -962,7 +965,7 @@ size_t setup_reply(HEADER *header, size_t qlen,
       add_resource_record(header, NULL, NULL, sizeof(HEADER), &p, ttl, NULL, T_A, C_IN, "4", addrp);
     }
 #ifdef HAVE_IPV6
-  else if (p && flags == F_IPV6)
+  else if (flags == F_IPV6)
     {
       header->rcode = NOERROR;
       header->ancount = htons(1);

signature.asc
Description: Digital signature