upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-03-19 09:09:36 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge branch '3493-confidential-compression-buffer-reuse-v9_18' into 'security-v9_18'

Browse source 
[v9_18][CVE-2022-2881] compression buffer was not reused correctly

See merge request isc-private/bind9!436
This commit is contained in:
Michał Kępień 2022-09-08 09:43:50 +00:00
commit 648eca7698
3 changed files with 15 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
CHANGES
View file

@ -1,3 +1,10 @@
5958. [security] When an HTTP connection was reused to get
statistics from the stats channel, and zlib
compression was in use, each successive
response sent larger and larger blocks of memory,
potentially reading past the end of the allocated
buffer. (CVE-2022-2881) [GL #3493]
5957. [security] Prevent excessive resource use while processing large
delegations. (CVE-2022-2795) [GL #3394]

5
doc/notes/notes-current.rst
View file

@ -24,6 +24,11 @@ Security Fixes
Bremler-Barr & Shani Stajnrod from Reichman University for bringing
this vulnerability to our attention. :gl:`#3394`
- When an HTTP connection was reused to request statistics from the
stats channel, the content length of successive responses could grow
in size past the end of the allocated buffer. This has been fixed.
(CVE-2022-2881) :gl:`#3493`
Known Issues
~~~~~~~~~~~~

3
lib/isc/httpd.c
View file

@ -202,6 +202,8 @@ free_buffer(isc_mem_t *mctx, isc_buffer_t *buffer) {
if (r.base != NULL) {
isc_mem_put(mctx, r.base, r.length);
}
isc_buffer_initnull(buffer);
}
isc_result_t
@ -861,6 +863,7 @@ httpd_compress(isc_httpd_t *httpd) {
inputlen = isc_buffer_usedlength(&httpd->bodybuffer);
alloc_compspace(httpd, inputlen);
isc_buffer_clear(&httpd->compbuffer);
isc_buffer_region(&httpd->compbuffer, &r);
/*