Mercurial > hg > nginx

changeset 7860:a45b6a206cfc stable-1.20

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Resolver: fixed label types handling in ngx_resolver_copy(). Previously, anything with any of the two high bits set were interpreted as compression pointers. This is incorrect, as RFC 1035 clearly states that "The 10 and 01 combinations are reserved for future use". Further, the 01 combination is actually allocated for EDNS extended label type (see RFC 2671 and RFC 6891), not really used though. Fix is to reject unrecognized label types rather than misinterpreting them as compression pointers.
author Maxim Dounin <mdounin@mdounin.ru>
date Tue, 25 May 2021 15:17:41 +0300
parents 5d561a77502e
children 0b884e47bb79
files src/core/ngx_resolver.c
diffstat 1 files changed, 5 insertions(+), 0 deletions(-) [+]
line wrap: on
line diff
--- a/src/core/ngx_resolver.c
+++ b/src/core/ngx_resolver.c
@@ -3958,6 +3958,11 @@ ngx_resolver_copy(ngx_resolver_t *r, ngx
         }
 
         if (n & 0xc0) {
+            if ((n & 0xc0) != 0xc0) {
+                err = "invalid label type in DNS response";
+                goto invalid;
+            }
+
             if (p >= last) {
                 err = "name is out of DNS response";
                 goto invalid;