Launchpad has imported 3 comments from the remote bug at
http://sourceware.org/bugzilla/show_bug.cgi?id=10360.

If you reply to an imported comment from within Launchpad, your comment
will be sent to the remote bug automatically. Read more about
Launchpad's inter-bugtracker facilities at
https://help.launchpad.net/InterBugTracking.

------------------------------------------------------------------------
On 2009-07-03T15:26:40+00:00 Bugzilla-webform wrote:

Resolver functions allow buffer sizes > 65535 bytes. If RES_USE_EDNS0 is set,
res_nopt() truncates this value to 16 bit, resulting in an incorrect buffer size
advertised in EDNS query headers.

portable OpenSSH triggers this behaviour, as described here:
http://marc.info/?l=openssh-unix-dev&m=124625332427704&w=2

openbsd-compat/getrrsetbyname() sets a buffer size of 65536 bytes. In the glibc
stub-resolver, it is eventually passed on as "anslen" to __res_nopt() in
resolv/res_mkquery.c:
[...]
        NS_PUT16(anslen & 0xffff, cp); /* CLASS = UDP payload size */

and sent out to the recursor (UDPsize: 0xf0000 & 0xffff == 0)

| IP 127.0.0.1.44138 > 127.0.0.1.53: 31454+ [1au] SSHFP?
orbit.attraktor.org. ar: . OPT UDPsize=0 (48)
| IP 127.0.0.1.53 > 127.0.0.1.44138: 31454 ServFail-| [0q] 0/0/0 (12)

Reply at: https://bugs.launchpad.net/glibc/+bug/395196/comments/2

------------------------------------------------------------------------
On 2009-07-03T15:28:00+00:00 Bugzilla-webform wrote:

Created attachment 4035
cap anslen in res_nopt() at 0xffff. assert() inserted because I'm not sure if 
negative values could be passed to res_nopt()

cap anslen in res_nopt() at 0xffff

assert() inserted because I'm not sure if negative values could be passed to
res_nopt()

Reply at: https://bugs.launchpad.net/glibc/+bug/395196/comments/3

------------------------------------------------------------------------
On 2009-07-17T06:44:36+00:00 Drepper-fsp wrote:

The code comes from bind upstream.  I've checked in a similar patch.

Reply at: https://bugs.launchpad.net/glibc/+bug/395196/comments/5


** Changed in: glibc
   Importance: Unknown => Low

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/395196

Title:
  EDNS0: res_nopt truncates buffer size incorrectly

-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to