search

mfontanini / libtins

High-level, multiplatform C++ network packet sniffing and crafting library.
http://libtins.github.io/
BSD 2-Clause "Simplified" License
1.89k stars 374 forks source link

dns: parser reads into garbage on misreported packet size #468

Closed bwillcox closed 2 years ago

bwillcox commented 2 years ago

The unit test demonstrates the following issue. The DNS packet is valid, but the packet size is misreported to be larger than the size of the valid packet. Attempting to get RR's for the additional section causes the parser to read into garbage past the end of the packet. This results in a malformed packet exception.

There is no language in the spec that addresses this use case. However, the RR counts in the header provide sufficient data for the parser to know when it could stop parsing.

Added code to limit RR fetch to count specified in header.

mfontanini commented 2 years ago

Nice one. I'm curious whether you found this in the wild and how it would actually come to be? e.g. what would the trailer padding be in a real packet. Regardless, this seems reasonable so merging!

bwillcox commented 2 years ago

Nice one. I'm curious whether you found this in the wild and how it would actually come to be? e.g. what would the trailer padding be in a real packet. Regardless, this seems reasonable so merging!

It's from the wild. We don't understand the bad packet size root cause. It only happens on some networks and one operating system and is only reproducible in some environments. The bad data seems random - mostly zeroes. This was a major trouble maker! :)