From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Tamara Schmitz <tschmitz@suse.com>
Date: Wed, 27 Mar 2024 12:15:38 +0200
Subject: [PATCH] Limit isccc_cc_fromwire recursion depth
    
Named and rndc do not need a lot of recursion so the depth is
set to 10.

Sending a specially crafted message over the control channel could
cause the packet-parsing code to run out of available stack memory,
causing named to terminate unexpectedly.

Parsing is done before authentication, so exploiting this vulnerability
doesn't require a valid RNDC key.

[iluceno@suse.de: Patch normalised, based on ISC's repo; original
 commit: 820b0cceef0b ("Limit isccc_cc_fromwire recursion depth",
 2023-06-20), from Mark Andrews <marka@isc.org>]
Fixes: CVE-2023-3341
Signed-off-by: Ismael Luceno <iluceno@suse.de>
---
 lib/isccc/cc.c                   |   39 +++++++++++++++++++++++++++++----------
 lib/isccc/include/isccc/result.h |    4 +++-
 lib/isccc/result.c               |    3 ++-
 3 files changed, 34 insertions(+), 12 deletions(-)

diff --git a/lib/isccc/cc.c b/lib/isccc/cc.c
index ae5391a..5652596 100644
--- a/lib/isccc/cc.c
+++ b/lib/isccc/cc.c
@@ -56,6 +56,10 @@
 
 #define MAX_TAGS		256
 #define DUP_LIFETIME		900
+#ifndef ISCCC_MAXDEPTH
+#define ISCCC_MAXDEPTH \
+	10 /* Big enough for rndc which just sends a string each way. */
+#endif
 
 typedef isccc_sexpr_t *sexpr_ptr;
 
@@ -321,13 +325,15 @@ verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length,
 
 static isc_result_t
 table_fromwire(isccc_region_t *source, isccc_region_t *secret,
-	       isccc_sexpr_t **alistp);
+	       unsigned int depth, isccc_sexpr_t **alistp);
 
 static isc_result_t
-list_fromwire(isccc_region_t *source, isccc_sexpr_t **listp);
+list_fromwire(isccc_region_t *source, unsigned int depth,
+              isccc_sexpr_t **listp);
 
 static isc_result_t
-value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep)
+value_fromwire(isccc_region_t *source, unsigned int depth,
+               isccc_sexpr_t **valuep)
 {
 	unsigned int msgtype;
 	isc_uint32_t len;
@@ -335,6 +341,10 @@ value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep)
 	isccc_region_t active;
 	isc_result_t result;
 
+	if (depth > ISCCC_MAXDEPTH) {
+		return (ISCCC_R_MAXDEPTH);
+	}
+
 	if (REGION_SIZE(*source) < 1 + 4)
 		return (ISC_R_UNEXPECTEDEND);
 	GET8(msgtype, source->rstart);
@@ -352,9 +362,9 @@ value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep)
 		} else
 			result = ISC_R_NOMEMORY;
 	} else if (msgtype == ISCCC_CCMSGTYPE_TABLE)
-		result = table_fromwire(&active, NULL, valuep);
+        	result = table_fromwire(&active, NULL, depth + 1, valuep);
 	else if (msgtype == ISCCC_CCMSGTYPE_LIST)
-		result = list_fromwire(&active, valuep);
+        	result = list_fromwire(&active, depth + 1, valuep);
 	else
 		result = ISCCC_R_SYNTAX;
 
@@ -363,7 +373,7 @@ value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep)
 
 static isc_result_t
 table_fromwire(isccc_region_t *source, isccc_region_t *secret,
-	       isccc_sexpr_t **alistp)
+	       unsigned int depth, isccc_sexpr_t **alistp)
 {
 	char key[256];
 	isc_uint32_t len;
@@ -374,6 +384,10 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
 
 	REQUIRE(alistp != NULL && *alistp == NULL);
 
+	if (depth > ISCCC_MAXDEPTH) {
+		return (ISCCC_R_MAXDEPTH);
+	}
+
 	checksum_rstart = NULL;
 	first_tag = ISC_TRUE;
 	alist = isccc_alist_create();
@@ -389,7 +403,7 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
 		GET_MEM(key, len, source->rstart);
 		key[len] = '\0';	/* Ensure NUL termination. */
 		value = NULL;
-		result = value_fromwire(source, &value);
+		result = value_fromwire(source, depth + 1, &value);
 		if (result != ISC_R_SUCCESS)
 			goto bad;
 		if (isccc_alist_define(alist, key, value) == NULL) {
@@ -421,15 +435,20 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
 }
 
 static isc_result_t
-list_fromwire(isccc_region_t *source, isccc_sexpr_t **listp)
+list_fromwire(isccc_region_t *source, unsigned int depth,
+	     isccc_sexpr_t **listp)
 {
 	isccc_sexpr_t *list, *value;
 	isc_result_t result;
 
+	if (depth > ISCCC_MAXDEPTH) {
+		return (ISCCC_R_MAXDEPTH);
+	}
+
 	list = NULL;
 	while (!REGION_EMPTY(*source)) {
 		value = NULL;
-		result = value_fromwire(source, &value);
+		result = value_fromwire(source, depth + 1, &value);
 		if (result != ISC_R_SUCCESS) {
 			isccc_sexpr_free(&list);
 			return (result);
@@ -460,7 +479,7 @@ isccc_cc_fromwire(isccc_region_t *source, isccc_sexpr_t **alistp,
 	if (version != 1)
 		return (ISCCC_R_UNKNOWNVERSION);
 
-	return (table_fromwire(source, secret, alistp));
+	return (table_fromwire(source, secret, 0, alistp));
 }
 
 static isc_result_t
diff --git a/lib/isccc/include/isccc/result.h b/lib/isccc/include/isccc/result.h
index 2d54969..9458275 100644
--- a/lib/isccc/include/isccc/result.h
+++ b/lib/isccc/include/isccc/result.h
@@ -54,8 +54,10 @@
 #define ISCCC_R_CLOCKSKEW		(ISC_RESULTCLASS_ISCCC + 4)
 /*% Duplicate */
 #define ISCCC_R_DUPLICATE		(ISC_RESULTCLASS_ISCCC + 5)
+/*% Maximum recursion depth */
+#define ISCCC_R_MAXDEPTH		(ISC_RESULTCLASS_ISCCC + 6)
 
-#define ISCCC_R_NRESULTS 		6	/*%< Number of results */
+#define ISCCC_R_NRESULTS		7	/*%< Number of results */
 
 ISC_LANG_BEGINDECLS
 
diff --git a/lib/isccc/result.c b/lib/isccc/result.c
index cbedc16..3c6f49d 100644
--- a/lib/isccc/result.c
+++ b/lib/isccc/result.c
@@ -47,7 +47,8 @@ static const char *text[ISCCC_R_NRESULTS] = {
 	"bad auth",				/* 3 */
 	"expired",				/* 4 */
 	"clock skew",				/* 5 */
-	"duplicate"				/* 6 */
+	"duplicate",				/* 6 */
+	"max depth"				/* 7 */
 };
 
 #define ISCCC_RESULT_RESULTSET			2
-- 
Fixed up by sm-checkpatch 0.1

