From owner-freebsd-ports-bugs@FreeBSD.ORG Wed May 16 19:10:02 2012 Return-Path: Delivered-To: freebsd-ports-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 5FA8D106566B for ; Wed, 16 May 2012 19:10:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 3665E8FC20 for ; Wed, 16 May 2012 19:10:02 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.5/8.14.5) with ESMTP id q4GJA2j0070382 for ; Wed, 16 May 2012 19:10:02 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.5/8.14.5/Submit) id q4GJA20k070381; Wed, 16 May 2012 19:10:02 GMT (envelope-from gnats) Resent-Date: Wed, 16 May 2012 19:10:02 GMT Resent-Message-Id: <201205161910.q4GJA20k070381@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Mark Felder Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 9D8F3106567B for ; Wed, 16 May 2012 19:04:24 +0000 (UTC) (envelope-from feld@feld.me) Received: from feld.me (unknown [IPv6:2607:f4e0:100:300::2]) by mx1.freebsd.org (Postfix) with ESMTP id 52AD78FC21 for ; Wed, 16 May 2012 19:04:24 +0000 (UTC) Received: from feld by feld.me with local (Exim 4.77 (FreeBSD)) (envelope-from ) id 1SUjWJ-000Fhl-4g for FreeBSD-gnats-submit@freebsd.org; Wed, 16 May 2012 14:04:23 -0500 Message-Id: Date: Wed, 16 May 2012 14:04:23 -0500 From: Mark Felder To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: Subject: ports/167975: [PATCH] irc/inspircd: update to 2.0.5 X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 May 2012 19:10:02 -0000 >Number: 167975 >Category: ports >Synopsis: [PATCH] irc/inspircd: update to 2.0.5 >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: update >Submitter-Id: current-users >Arrival-Date: Wed May 16 19:10:01 UTC 2012 >Closed-Date: >Last-Modified: >Originator: feld >Release: FreeBSD 9.0-STABLE amd64 >Organization: >Environment: System: FreeBSD mwi1.coffeenet.org 9.0-STABLE FreeBSD 9.0-STABLE #3 r234963: Thu May 3 13:12:01 >Description: - Update to 2.0.5 - Backport dns.cpp to resolve remote DoS vuln Added file(s): - files/patch-src_dns.cpp Generated with FreeBSD Port Tools 0.99_5 (mode: update, diff: suffix) >How-To-Repeat: >Fix: --- inspircd-2.0.5.patch begins here --- diff -ruN --exclude=CVS ../inspircd.orig/Makefile ./Makefile --- ../inspircd.orig/Makefile 2012-01-27 15:38:43.000000000 -0600 +++ ./Makefile 2012-05-15 21:52:21.000000000 -0500 @@ -6,15 +6,16 @@ # PORTNAME= inspircd -PORTVERSION= 2.0.2 -PORTREVISION= 1 +PORTVERSION= 2.0.5 CATEGORIES= irc -MASTER_SITES= SF/${PORTNAME}/InspIRCd-2.0/${PORTVERSION} +MASTER_SITES= http://cloud.github.com/downloads/inspircd/inspircd/ DISTNAME= InspIRCd-${PORTVERSION} MAINTAINER= ports@FreeBSD.org COMMENT= A modular C++ IRC daemon +CONFLICTS= inspircd-1.* + USE_BZIP2= yes USE_RC_SUBR= ${PORTNAME} MAKEFILE= BSDmakefile diff -ruN --exclude=CVS ../inspircd.orig/distinfo ./distinfo --- ../inspircd.orig/distinfo 2011-03-18 00:01:25.000000000 -0500 +++ ./distinfo 2012-05-15 21:45:17.000000000 -0500 @@ -1,2 +1,2 @@ -SHA256 (InspIRCd-2.0.2.tar.bz2) = 2ebd2af56da57d68f779c1f707c804b7a480d50c8c943d440f78732e416ab220 -SIZE (InspIRCd-2.0.2.tar.bz2) = 583791 +SHA256 (InspIRCd-2.0.5.tar.bz2) = 425bf79ae1348b398ce6d2348f6cc8baeebe8125f62337e98c136942223f4fc6 +SIZE (InspIRCd-2.0.5.tar.bz2) = 575852 diff -ruN --exclude=CVS ../inspircd.orig/files/patch-src_dns.cpp ./files/patch-src_dns.cpp --- ../inspircd.orig/files/patch-src_dns.cpp 1969-12-31 18:00:00.000000000 -0600 +++ ./files/patch-src_dns.cpp 2012-05-16 08:29:59.000000000 -0500 @@ -0,0 +1,135 @@ +--- src/dns.cpp.orig 2012-05-15 21:45:31.840274636 -0500 ++++ src/dns.cpp 2012-05-15 21:45:58.653278686 -0500 +@@ -38,6 +49,8 @@ + #include "configreader.h" + #include "socket.h" + ++#define DN_COMP_BITMASK 0xC000 /* highest 6 bits in a DN label header */ ++ + /** Masks to mask off the responses we get from the DNSRequest methods + */ + enum QueryInfo +@@ -98,7 +111,7 @@ + + DNSRequest(DNS* dns, int id, const std::string &original); + ~DNSRequest(); +- DNSInfo ResultIsReady(DNSHeader &h, int length); ++ DNSInfo ResultIsReady(DNSHeader &h, unsigned length); + int SendRequests(const DNSHeader *header, const int length, QueryType qt); + }; + +@@ -161,7 +174,10 @@ + /* Allocate the processing buffer */ + DNSRequest::DNSRequest(DNS* dns, int rid, const std::string &original) : dnsobj(dns) + { +- res = new unsigned char[512]; ++ /* hardening against overflow here: make our work buffer twice the theoretical ++ * maximum size so that hostile input doesn't screw us over. ++ */ ++ res = new unsigned char[sizeof(DNSHeader) * 2]; + *res = 0; + orig = original; + RequestTimeout* RT = new RequestTimeout(ServerInstance->Config->dns_timeout ? ServerInstance->Config->dns_timeout : 5, this, rid); +@@ -688,11 +704,11 @@ + } + + /** A result is ready, process it */ +-DNSInfo DNSRequest::ResultIsReady(DNSHeader &header, int length) ++DNSInfo DNSRequest::ResultIsReady(DNSHeader &header, unsigned length) + { +- int i = 0; ++ unsigned i = 0, o; + int q = 0; +- int curanswer, o; ++ int curanswer; + ResourceRecord rr; + unsigned short ptr; + +@@ -755,7 +771,7 @@ + else i += header.payload[i] + 1; /* skip length and label */ + } + } +- if (length - i < 10) ++ if (static_cast(length - i) < 10) + return std::make_pair((unsigned char*)NULL,"Incorrectly sized DNS reply"); + + /* XXX: We actually initialise 'rr' here including its ttl field */ +@@ -790,17 +806,37 @@ + + switch (rr.type) + { ++ /* ++ * CNAME and PTR are compressed. We need to decompress them. ++ */ + case DNS_QUERY_CNAME: +- /* CNAME and PTR have the same processing code */ + case DNS_QUERY_PTR: ++ { ++ unsigned short lowest_pos = length; + o = 0; + q = 0; + while (q == 0 && i < length && o + 256 < 1023) + { ++ /* DN label found (byte over 63) */ + if (header.payload[i] > 63) + { + memcpy(&ptr,&header.payload[i],2); +- i = ntohs(ptr) - 0xC000 - 12; ++ ++ i = ntohs(ptr); ++ ++ /* check that highest two bits are set. if not, we've been had */ ++ if ((i & DN_COMP_BITMASK) != DN_COMP_BITMASK) ++ return std::make_pair((unsigned char *) NULL, "DN label decompression header is bogus"); ++ ++ /* mask away the two highest bits. */ ++ i &= ~DN_COMP_BITMASK; ++ ++ /* and decrease length by 12 bytes. */ ++ i -= 12; ++ ++ if (i >= lowest_pos) ++ return std::make_pair((unsigned char *) NULL, "Invalid decompression pointer"); ++ lowest_pos = i; + } + else + { +@@ -813,25 +849,35 @@ + res[o] = 0; + if (o != 0) + res[o++] = '.'; +- memcpy(&res[o],&header.payload[i + 1],header.payload[i]); ++ ++ if (o + header.payload[i] > sizeof(DNSHeader)) ++ return std::make_pair((unsigned char *) NULL, "DN label decompression is impossible -- malformed/hostile packet?"); ++ ++ memcpy(&res[o], &header.payload[i + 1], header.payload[i]); + o += header.payload[i]; + i += header.payload[i] + 1; + } + } + } + res[o] = 0; ++ } + break; + case DNS_QUERY_AAAA: ++ if (rr.rdlength != sizeof(struct in6_addr)) ++ return std::make_pair((unsigned char *) NULL, "rr.rdlength is larger than 16 bytes for an ipv6 entry -- malformed/hostile packet?"); ++ + memcpy(res,&header.payload[i],rr.rdlength); + res[rr.rdlength] = 0; + break; + case DNS_QUERY_A: ++ if (rr.rdlength != sizeof(struct in_addr)) ++ return std::make_pair((unsigned char *) NULL, "rr.rdlength is larger than 4 bytes for an ipv4 entry -- malformed/hostile packet?"); ++ + memcpy(res,&header.payload[i],rr.rdlength); + res[rr.rdlength] = 0; + break; + default: +- memcpy(res,&header.payload[i],rr.rdlength); +- res[rr.rdlength] = 0; ++ return std::make_pair((unsigned char *) NULL, "don't know how to handle undefined type (" + ConvToStr(rr.type) + ") -- rejecting"); + break; + } + return std::make_pair(res,"No error"); --- inspircd-2.0.5.patch ends here --- >Release-Note: >Audit-Trail: >Unformatted: