Security fix, CVE-2017-14496, Integer underflow in DNS response creation.

Fix DoS in DNS. Invalid boundary checks in the
    add_pseudoheader function allows a memcpy call with negative
    size An attacker which can send malicious DNS queries
    to dnsmasq can trigger a DoS remotely.
    dnsmasq is vulnerable only if one of the following option is
    specified: --add-mac, --add-cpe-id or --add-subnet.

Signed-off-by: Petr Menšík <pemensik@redhat.com>

dnsmasq-2.77-CVE-2017-14496.patch

@@ -0,0 +1,66 @@
+From 897c113fda0886a28a986cc6ba17bb93bd6cb1c7 Mon Sep 17 00:00:00 2001
+From: Simon Kelley <simon@thekelleys.org.uk>
+Date: Mon, 25 Sep 2017 20:11:58 +0100
+Subject: [PATCH 6/9] Security fix, CVE-2017-14496, Integer underflow in DNS
+ response creation.
+
+Fix DoS in DNS. Invalid boundary checks in the
+add_pseudoheader function allows a memcpy call with negative
+size An attacker which can send malicious DNS queries
+to dnsmasq can trigger a DoS remotely.
+dnsmasq is vulnerable only if one of the following option is
+specified: --add-mac, --add-cpe-id or --add-subnet.
+---
+ src/edns0.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/src/edns0.c b/src/edns0.c
+index f5b798c..95b74ee 100644
+--- a/src/edns0.c
++++ b/src/edns0.c
+@@ -144,7 +144,7 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
+ 	  GETSHORT(len, p);
+ 	  
+ 	  /* malformed option, delete the whole OPT RR and start again. */
+-	  if (i + len > rdlen)
++	  if (i + 4 + len > rdlen)
+ 	    {
+ 	      rdlen = 0;
+ 	      is_last = 0;
+@@ -193,6 +193,8 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
+ 			     ntohs(header->ancount) + ntohs(header->nscount) + ntohs(header->arcount), 
+ 			     header, plen)))
+ 	return plen;
++      if (p + 11 > limit)
++       return plen; /* Too big */
+       *p++ = 0; /* empty name */
+       PUTSHORT(T_OPT, p);
+       PUTSHORT(udp_sz, p); /* max packet length, 512 if not given in EDNS0 header */
+@@ -204,6 +206,11 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
+       /* Copy back any options */
+       if (buff)
+ 	{
++          if (p + rdlen > limit)
++          {
++            free(buff);
++            return plen; /* Too big */
++          }
+ 	  memcpy(p, buff, rdlen);
+ 	  free(buff);
+ 	  p += rdlen;
+@@ -220,8 +227,12 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
+   /* Add new option */
+   if (optno != 0 && replace != 2)
+     {
++      if (p + 4 > limit)
++       return plen; /* Too big */
+       PUTSHORT(optno, p);
+       PUTSHORT(optlen, p);
++      if (p + optlen > limit)
++       return plen; /* Too big */
+       memcpy(p, opt, optlen);
+       p += optlen;  
+       PUTSHORT(p - datap, lenp);
+-- 
+2.9.5
+

dnsmasq.spec

@@ -27,6 +27,7 @@ Patch2:         dnsmasq-2.77-CVE-2017-14491.patch
 Patch3:         dnsmasq-2.77-CVE-2017-14492.patch
 Patch4:         dnsmasq-2.77-CVE-2017-14493.patch
 Patch5:         dnsmasq-2.77-CVE-2017-14494.patch
+Patch6:         dnsmasq-2.77-CVE-2017-14496.patch
 
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -66,6 +67,7 @@ query/remove a DHCP server's leases.
 %patch3 -p1 -b .CVE-2017-14492
 %patch4 -p1 -b .CVE-2017-14493
 %patch5 -p1 -b .CVE-2017-14494
+%patch6 -p1 -b .CVE-2017-14496
 
 # use /var/lib/dnsmasq instead of /var/lib/misc
 for file in dnsmasq.conf.example man/dnsmasq.8 man/es/dnsmasq.8 src/config.h; do
@@ -157,6 +159,7 @@ rm -rf $RPM_BUILD_ROOT
 - Security fix, CVE-2017-14492, DHCPv6 RA heap overflow
 - Security fix, CVE-2017-14493, DHCPv6 - Stack buffer overflow
 - Security fix, CVE-2017-14494, Infoleak handling DHCPv6
+- Security fix, CVE-2017-14496, Integer underflow in DNS response creation
 
 * Thu Sep 14 2017 Petr Menšík <pemensik@redhat.com> - 2.77-7
 - Fix CVE-2017-13704