mirror of
http://git.haproxy.org/git/haproxy.git/
synced 2025-01-25 23:12:54 +00:00
00488ddef5
The maximum number of bytes in a DNS name is indeed 255, but we need to allocate one more byte for the NULL-terminating byte. Otherwise dns_read_name() might return 255 for a very long name, causing dns_validate_dns_response() to write a NULL value one byte after the end of the buffer: dns_answer_record->name[len] = 0; The next fields in the struct being filled from the content of the query, it might have been possible to fill them with non-0 values, causing for example a strlen() of the name to read past the end of the struct and access unintended parts of the memory, possibly leading to a crash. To be backported to 1.8, probably also 1.7. |
||
|---|---|---|
| .. | ||
| acl.h | ||
| action.h | ||
| activity.h | ||
| applet.h | ||
| arg.h | ||
| auth.h | ||
| backend.h | ||
| cache.h | ||
| capture.h | ||
| channel.h | ||
| checks.h | ||
| cli.h | ||
| compression.h | ||
| connection.h | ||
| counters.h | ||
| dns.h | ||
| fd.h | ||
| filters.h | ||
| freq_ctr.h | ||
| global.h | ||
| hdr_idx.h | ||
| hlua.h | ||
| http_htx.h | ||
| lb_chash.h | ||
| lb_fas.h | ||
| lb_fwlc.h | ||
| lb_fwrr.h | ||
| lb_map.h | ||
| listener.h | ||
| log.h | ||
| mailers.h | ||
| map.h | ||
| obj_type.h | ||
| pattern.h | ||
| peers.h | ||
| pipe.h | ||
| port_range.h | ||
| proto_http.h | ||
| proto_udp.h | ||
| protocol.h | ||
| proxy.h | ||
| queue.h | ||
| sample.h | ||
| server.h | ||
| session.h | ||
| shctx.h | ||
| signal.h | ||
| spoe.h | ||
| ssl_sock.h | ||
| stats.h | ||
| stick_table.h | ||
| stream_interface.h | ||
| stream.h | ||
| task.h | ||
| template.h | ||
| vars.h | ||