From a4e1db793d4971d87631276ea57808074ed2c1c7 Mon Sep 17 00:00:00 2001 From: Petr Mensik Date: Thu, 21 Feb 2019 17:23:53 +0100 Subject: [PATCH 1/3] Fix CVE-2018-5744 5110. [security] Named leaked memory if there were multiple Key Tag EDNS options present. (CVE-2018-5744) [GL #772] --- bin/named/client.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/bin/named/client.c b/bin/named/client.c index b9ebc93..b7d8a98 100644 --- a/bin/named/client.c +++ b/bin/named/client.c @@ -2112,6 +2112,12 @@ process_keytag(ns_client_t *client, isc_buffer_t *buf, size_t optlen) { return (DNS_R_OPTERR); } + /* Silently drop additional keytag options. */ + if (client->keytag != NULL) { + isc_buffer_forward(buf, (unsigned int)optlen); + return (ISC_R_SUCCESS); + } + client->keytag = isc_mem_get(client->mctx, optlen); if (client->keytag != NULL) { client->keytag_len = (isc_uint16_t)optlen; -- 2.20.1