DANE: ignore undersized TLSA records

diff --git a/src/src/dns.c b/src/src/dns.c
index 1da7feb38366363bc41406f72f63250172f36ba9..297b8b88da7f253be56807459cb5d9e38c4c14e2 100644 (file)
--- a/src/src/dns.c
+++ b/src/src/dns.c
@@ -885,7 +885,7 @@ for (i = 0; i <= dns_cname_loops; i++)
   uschar * data;
   dns_record *rr, cname_rr, type_rr;
   dns_scan dnss;
   uschar * data;
   dns_record *rr, cname_rr, type_rr;
   dns_scan dnss;

-  int datalen, rc;
+  int rc;

 
   /* DNS lookup failures get passed straight back. */
 
 
   /* DNS lookup failures get passed straight back. */
 


@@ -947,8 +947,8 @@ for (i = 0; i <= dns_cname_loops; i++)
     return DNS_FAIL;
 
   data = store_get(256);
     return DNS_FAIL;
 
   data = store_get(256);

-  if ((datalen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
-    cname_rr.data, (DN_EXPAND_ARG4_TYPE)data, 256)) < 0)
+  if (dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
+      cname_rr.data, (DN_EXPAND_ARG4_TYPE)data, 256) < 0)

     return DNS_FAIL;
   name = data;
 
     return DNS_FAIL;
   name = data;
 

diff --git a/src/src/tls-gnu.c b/src/src/tls-gnu.c
index fd18a601e5bbd60cb2d617f65a713d6b206f13ee..1430f2f3c56fd3acb90132d009c33e17a46fabeb 100644 (file)
--- a/src/src/tls-gnu.c
+++ b/src/src/tls-gnu.c
@@ -2207,7 +2207,7 @@ dane_data_len = store_get(i * sizeof(int));
 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS), i = 0;
      rr;
      rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS), i = 0;
      rr;
      rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)

-    ) if (rr->type == T_TLSA)
+    ) if (rr->type == T_TLSA && rr->size > 3)

   {
   const uschar * p = rr->data;
   uint8_t usage = p[0], sel = p[1], type = p[2];
   {
   const uschar * p = rr->data;
   uint8_t usage = p[0], sel = p[1], type = p[2];


@@ -2774,7 +2774,7 @@ while (left > 0)
   DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
   if (outbytes < 0)
     {
   DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
   if (outbytes < 0)
     {

-debug_printf("%s: err from gnutls_record_send(\n", __FUNCTION__);
+    DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);

     record_io_error(state, outbytes, US"send", NULL);
     return -1;
     }
     record_io_error(state, outbytes, US"send", NULL);
     return -1;
     }

diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index 81372cfaac91746561511cee43f823af8330478a..c5ebc1333546ae7cbfb2e29067b27c77bebf9ac3 100644 (file)
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -2337,7 +2337,7 @@ if (DANESSL_init(ssl, NULL, hostnames) != 1)
 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
      rr;
      rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
      rr;
      rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)

-    ) if (rr->type == T_TLSA)
+    ) if (rr->type == T_TLSA && rr->size > 3)

   {
   const uschar * p = rr->data;
   uint8_t usage, selector, mtype;
   {
   const uschar * p = rr->data;
   uint8_t usage, selector, mtype;

diff --git a/src/src/transports/smtp.c b/src/src/transports/smtp.c
index d7e83966f70c9f5cbf667aa9254e3e5fe9b2af5f..f3e09ada7c91cd69c1875fbc6b5e50e9ee35d439 100644 (file)
--- a/src/src/transports/smtp.c
+++ b/src/src/transports/smtp.c
@@ -1254,19 +1254,20 @@ switch (rc)
        dns_scan dnss;
        dns_record * rr;
        for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
        dns_scan dnss;
        dns_record * rr;
        for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;

-            rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == T_TLSA)
-         {
-         uint16_t payload_length = rr->size - 3;
-         uschar s[MAX_TLSA_EXPANDED_SIZE], * sp = s, * p = US rr->data;
+            rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
+         if (rr->type == T_TLSA && rr->size > 3)
+           {
+           uint16_t payload_length = rr->size - 3;
+           uschar s[MAX_TLSA_EXPANDED_SIZE], * sp = s, * p = US rr->data;

 
 

-         sp += sprintf(CS sp, "%d ", *p++); /* usage */
-         sp += sprintf(CS sp, "%d ", *p++); /* selector */
-         sp += sprintf(CS sp, "%d ", *p++); /* matchtype */
-         while (payload_length-- > 0 && sp-s < (MAX_TLSA_EXPANDED_SIZE - 4))
-           sp += sprintf(CS sp, "%02x", *p++);
+           sp += sprintf(CS sp, "%d ", *p++); /* usage */
+           sp += sprintf(CS sp, "%d ", *p++); /* selector */
+           sp += sprintf(CS sp, "%d ", *p++); /* matchtype */
+           while (payload_length-- > 0 && sp-s < (MAX_TLSA_EXPANDED_SIZE - 4))
+             sp += sprintf(CS sp, "%02x", *p++);

 
 

-         debug_printf(" %s\n", s);
-         }
+           debug_printf(" %s\n", s);
+           }

        }
       return OK;
       }
        }
       return OK;
       }