Bug 125433

Description:

An off-by-one error in the inet_network() function in libbind could lead to memory corruption with certain inputs. 

Impact:

Applications linked against libbind which call inet_network() with untrusted inputs could lead to a denial-of-service or potentially code execution.

http://www.isc.org/index.pl?/sw/bind/index.php

Fix: Solution:

Upgrade to 9.3.5, 9.4.3, 9.5.0b2 or later when released. 

Otherwise, apply the patch below to: 

BIND 9: lib/bind/inet/inet_network.c
BIND 8: lib/inet/inet_network.c 


Questions should be addressed to bind9-bugs@isc.org. 
Acknowledgements:
ISC would like to thank Nate Eldredge for reporting this.--It3NN9FVQ9tQbGnqHOC1TswlUGPxFGaFkpVSMkgouONadtYL
Content-Type: text/plain; name="file.diff"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="file.diff"

Index: inet_network.c
diff -u inet_network.c:1.5 inet_network.c:1.6
--- inet_network.c:1.5	Wed Apr 27 04:56:21 2005
+++ inet_network.c	Tue Jan 15 04:02:01 2008
@@ -84,9 +84,9 @@
 	}
 	if (!digit)
 		return (INADDR_NONE);
+	if (pp >= parts + 4 || val > 0xffU)
+		return (INADDR_NONE);
 	if (*cp == '.') {
-		if (pp >= parts + 4 || val > 0xffU)
-			return (INADDR_NONE);
 		*pp++ = val, cp++;
 		goto again;
 	}