Llt 7441 pnet dns crash#3
Conversation
Add cargo-fuzz targets for ipv4, ipv6, tcp, udp, icmp, icmpv6 and dns. Convert all fuzzers to the libfuzzer_sys::fuzz_target! convention and use std::hint::black_box so the reads aren't optimised out.
Opcode::new / Retcode::new hit unreachable!() for the 4-bit field values they didn't map, panicking on otherwise valid DNS headers. Modify it to match the convention used by other types.
The response/authority/additional length functions looped over query_count instead of their own record counts, and sliced the packet unchecked. A record whose packet_size (12 + attacker-controlled data_len) exceeded the buffer pushed offsets past the end and panicked. Use the correct per-section counts and only consume records that fully fit in the remaining bytes.
qname_length returned len+1 when the name had no zero terminator, so the generated qtype/qclass accessors indexed out of bounds. Cap it to leave room for the 4 trailing bytes.
get_qname_parsed indexed/sliced the name unchecked and unwrapped str::from_utf8, panicking on truncated labels or non-UTF-8 bytes. Walk the length-prefixed labels with checked access and String::from_utf8_lossy.
Fix ndp_option_payload_length's u8 overflow
jjanowsk
force-pushed
the
LLT-7441-pnet-dns-crash
branch
from
552a9da to
fb2096b
Compare
jjanowsk
force-pushed
the
LLT-7441-pnet-dns-crash
branch
from
fb2096b to
0ce3a91
Compare
jjanowsk
force-pushed
the
LLT-7441-pnet-dns-crash
branch
from
0ce3a91 to
09a136b
Compare
tomasz-grz
left a comment
tomasz-grz
left a comment
There was a problem hiding this comment.
What should we base the branch on? Looks like release/v0.35.0 is 40 commits behind main, which already has some fixes, like #2.
Also looks like our main is 13 commits behind upstream, is there anything worth pulling in from there?
I think we should base it on the latest release which we are currently using, which is |
3 participants
Add fuzz targets for all protocols that we use, and fix detected problems.
Get rid of the GRE protocol since we do not use it and it was panicking while being fuzzed.