Skip to content

FIX: CVE vulnerabilities #62

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
scribam wants to merge 2 commits into from
Closed

FIX: CVE vulnerabilities #62

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fe098e1
FIX: CVE vulnerabilities
Dec 20, 2024
f22d7dd
Fix unit tests
scribam Nov 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions modules/pico_dns_common.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,7 @@ pico_dns_namelen_comp( char *name )
char *
pico_dns_decompress_name( char *name, pico_dns_packet *packet )
{
uint16_t packet_len = sizeof(pico_dns_packet);
char decompressed_name[PICO_DNS_NAMEBUF_SIZE] = {
0
};
Expand All @@ -120,9 +121,17 @@ pico_dns_decompress_name( char *name, pico_dns_packet *packet )
uint16_t decompressed_index = 0;
char *label = NULL, *next = NULL;

if (!name || !packet) {
pico_err = PICO_ERR_EINVAL;
return NULL;
}

/* Reading labels until reaching to pointer or NULL terminator.
* Only one pointer is allowed in DNS compression, the pointer is always the last according to the RFC */
dns_name_foreach_label_safe(label, name, next, PICO_DNS_NAMEBUF_SIZE) {
if (!label || (*label & 0xFF) >= PICO_DNS_NAMEBUF_SIZE) {
return NULL;
}

uint8_t label_size = (uint8_t)(*label+1);
if (decompressed_index + label_size >= PICO_DNS_NAMEBUF_SIZE) {
Expand All @@ -140,6 +149,12 @@ pico_dns_decompress_name( char *name, pico_dns_packet *packet )
/* Found compression bits */
ptr = (uint16_t)((((uint16_t) *label) & 0x003F) << 8);
ptr = (uint16_t)(ptr | (uint16_t) *(label + 1));

/* Check if the pointer is within the packet */
if (ptr >= packet_len) {
return NULL;
}

label = (char *)((uint8_t *)packet + ptr);

dns_name_foreach_label_safe(label, label, next, PICO_DNS_NAMEBUF_SIZE-decompressed_index) {
Expand Down
6 changes: 6 additions & 0 deletions modules/pico_mdns.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2200,6 +2200,12 @@ pico_mdns_handle_data_as_answers_generic(struct pico_stack *S,
return -1;
}

// check that the number of answers/responses correspond to the number of questions
if (count != pico_tree_count(&S->MDNSOwnRecords)) {
mdns_dbg("Number of answers does not match the number of questions\n");
return -1;
}

/* TODO: When receiving multiple authoritative answers, */
/* they should be sorted in lexicographical order */
/* (just like in pico_mdns_record_am_i_lexi_later) */
Expand Down
22 changes: 21 additions & 1 deletion test/unit/modunit_pico_dns_common.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -374,7 +374,7 @@ START_TEST(tc_pico_dns_fill_packet_header) /* MARK: dns_fill_packet_header */
fail_unless(0 == memcmp((void *)header, (void *)query_buf, 12),
"Comparing query header failed!\n");

/* Create a answer header */
/* Create an answer header */
pico_dns_fill_packet_header(header, 0, 1, 1, 1);

fail_unless(0 == memcmp((void *)header, (void *)answer_buf, 12),
Expand Down Expand Up @@ -1042,10 +1042,30 @@ START_TEST(tc_pico_dns_decompress_name) /* MARK: dns_decompress_name */
char name[] = "\4mail\xc0\x02";
char name2[] = "\xc0\x02";
char buf[] = "00\6google\3com";
char empty_name[] = "";
char *ret;

printf("*********************** starting %s * \n", __func__);

/* NULL name */
ret = pico_dns_decompress_name(NULL, (pico_dns_packet *)buf);
fail_unless(ret == NULL, "pico_dns_decompress_name(NULL, ...) should be invalid\n");

/* NULL buf */
ret = pico_dns_decompress_name(name, NULL);
fail_unless(ret == NULL, "pico_dns_decompress_name(..., NULL) should be invalid\n");

/* Empty name */
ret = pico_dns_decompress_name(empty_name, (pico_dns_packet *)buf);

/* Fail conditions */
fail_unless(ret != NULL, "Name ptr returned is NULL");
fail_unless(strcmp(ret, "") == 0, "Not correctly decompressed: '%s'!\n", ret);

/* Free memory */
PICO_FREE(ret);
ret = NULL;

/* Test normal DNS name compression */
ret = pico_dns_decompress_name(name, (pico_dns_packet *)buf);

Expand Down
18 changes: 12 additions & 6 deletions test/unit/modunit_pico_mdns.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1584,7 +1584,6 @@ START_TEST(tc_mdns_handle_data_as_questions) /* MARK: handle_data_as_questions *
};
uint16_t len = 0;
uint8_t *ptr = NULL;
int ret = 0;
struct pico_dns_question *a = NULL, *b = NULL;
struct pico_mdns_record *record1 = NULL, *record2 = NULL;
struct pico_stack *S = NULL;
Expand All @@ -1598,7 +1597,6 @@ START_TEST(tc_mdns_handle_data_as_questions) /* MARK: handle_data_as_questions *
PICO_MDNS_QUESTION_FLAG_UNICAST_RES, 0);
fail_if(!a, "dns_question_create failed!\n");
pico_tree_insert(&qtree, a);
fail_unless(ret == 0, "dns_question_vector_add returned error!\n");
b = pico_mdns_question_create(qurl2, &len, PICO_PROTO_IPV4, PICO_DNS_TYPE_A,
0, 0);
fail_if(!b, "dns_question_create failed!\n");
Expand All @@ -1620,7 +1618,8 @@ START_TEST(tc_mdns_handle_data_as_questions) /* MARK: handle_data_as_questions *
pico_tree_insert(&S->MDNSOwnRecords, record1);
pico_tree_insert(&S->MDNSOwnRecords, record2);

ptr = ((uint8_t *)packet + 12);
/* Move past the DNS packet header */
ptr = ((uint8_t *)packet + sizeof(struct pico_dns_header));

antree = pico_mdns_handle_data_as_questions(S, &ptr, 2, packet);
fail_unless(2 == pico_tree_count(&antree),
Expand Down Expand Up @@ -1656,12 +1655,15 @@ START_TEST(tc_mdns_handle_data_as_answers) /* MARK: handle_data_as_answers */
fail_if(!a, "dns_record_create returned NULL!\n");
pico_tree_insert(&rtree, a->record);
pico_tree_insert(&rtree, b->record);
pico_tree_insert(&S->MDNSOwnRecords, a);
pico_tree_insert(&S->MDNSOwnRecords, b);

/* Try to create an answer packet */
packet = pico_dns_answer_create(&rtree, NULL, NULL, &len);
fail_if (packet == NULL, "mdns_answer_create returned NULL!\n");

ptr = ((uint8_t *)packet + 12);
/* Move past the DNS packet header */
ptr = ((uint8_t *)packet + sizeof(struct pico_dns_header));

ret = pico_mdns_handle_data_as_answers_generic(S, &ptr, 2, packet, 0);
fail_unless(0 == ret, "mdns_handle_data_as_answers failed!\n");
Expand Down Expand Up @@ -1696,12 +1698,15 @@ START_TEST(tc_mdns_handle_data_as_authorities) /* MARK: handle_data_as_authoriti
fail_if(!a, "dns_record_create returned NULL!\n");
pico_tree_insert(&rtree, a->record);
pico_tree_insert(&rtree, b->record);
pico_tree_insert(&S->MDNSOwnRecords, a);
pico_tree_insert(&S->MDNSOwnRecords, b);

/* Try to create an answer packet */
packet = pico_dns_answer_create(&rtree, NULL, NULL, &len);
fail_if (packet == NULL, "mdns_answer_create returned NULL!\n");

ptr = ((uint8_t *)packet + 12);
/* Move past the DNS packet header */
ptr = ((uint8_t *)packet + sizeof(struct pico_dns_header));

ret = pico_mdns_handle_data_as_answers_generic(S, &ptr, 2, packet, 1);
fail_unless(0 == ret, "mdns_handle_data_as_answers failed!\n");
Expand Down Expand Up @@ -1837,7 +1842,8 @@ START_TEST(tc_mdns_apply_known_answer_suppression) /* MARK: apply_k_a_s */
packet = pico_dns_answer_create(&antree, NULL, NULL, &len);
fail_if (packet == NULL, "mdns_answer_create returned NULL!\n");

ptr = ((uint8_t *)packet + 12);
/* Move past the DNS packet header */
ptr = ((uint8_t *)packet + sizeof(struct pico_dns_header));

printf("Applying Known answer suppression...\n");

Expand Down
Loading