mirror of
http://thekelleys.org.uk/git/dnsmasq.git
synced 2026-10-28 12:40:47 +00:00
Simon Kelley
738c049988
A flaw in the blockdata_read() function allows an attacker to overflow heap buffers. If memory allocation fails whilst reading data from an IPC pipe, some data is left unread in the pipe. This has the effect of desynchronising further reads from the pipe and allows an attacker to overflow a heap buffer. Note that the attack depends on running the dnsmasq process out of memory so that calls to malloc() begin to fail. This is difficult to do on most platforms, unless a small ulimit is set on the size of the dnsmasq process. This makes practical attacks somewhat difficult. Thanks to Michel Belleau for finding and characterising this vulnerability.