kgess-mirror/freebsd-src
1
0
Fork 0
mirror of https://git.freebsd.org/src.git synced 2026-01-11 19:57:22 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

rtsold: Validate entries in domain search lists

Browse source 
Reported by:	Kevin Day <kevin@your.org>
Approved by:	so
Security:	FreeBSD-SA-25:12.rtsold
Security:	CVE-2025-14558
This commit is contained in:
Mark Johnston 2025-12-15 20:50:08 +00:00
parent 2ed21f9090
commit bf804f69dd
1 changed files with 40 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

46
usr.sbin/rtsold/rtsol.c
View file

@ -776,6 +776,41 @@ call_script(const char *const argv[], struct script_msg_head_t *sm_head)
argv[0], status);
}
#define PERIOD 0x2e
#define hyphenchar(c) ((c) == 0x2d)
#define periodchar(c) ((c) == PERIOD)
#define alphachar(c) (((c) >= 0x41 && (c) <= 0x5a) || \
((c) >= 0x61 && (c) <= 0x7a))
#define digitchar(c) ((c) >= 0x30 && (c) <= 0x39)
#define borderchar(c) (alphachar(c) || digitchar(c))
#define middlechar(c) (borderchar(c) || hyphenchar(c))
static int
res_hnok(const char *dn)
{
int pch = PERIOD, ch = *dn++;
while (ch != '\0') {
int nch = *dn++;
if (periodchar(ch)) {
;
} else if (periodchar(pch)) {
if (!borderchar(ch))
return (0);
} else if (periodchar(nch) || nch == '\0') {
if (!borderchar(ch))
return (0);
} else {
if (!middlechar(ch))
return (0);
}
pch = ch, ch = nch;
}
return (1);
}
/* Decode domain name label encoding in RFC 1035 Section 3.1 */
static size_t
dname_labeldec(char *dst, size_t dlen, const char *src)
@ -804,12 +839,11 @@ dname_labeldec(char *dst, size_t dlen, const char *src)
}
*dst = '\0';
/*
* XXX validate that domain name only contains valid characters
* for two reasons: 1) correctness, 2) we do not want to pass
* possible malicious, unescaped characters like `` to a script
* or program that could be exploited that way.
*/
if (!res_hnok(dst_origin)) {
warnmsg(LOG_INFO, __func__,
"invalid domain name '%s' was ignored", dst_origin);
return (0);
}
return (src - src_origin);
}