Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 1 Jun 2020 09:24:21 +0300
From: Georgi Guninski <>
Subject: Exploitability of the integer overflows in djbdns 1.05?

 From my blog:

Exploitability of the integer overflows in djbdns 1.05?

TLDR: Are the integer overflows in djbdns 1.05 exploitable?

Background: there are integer overflows and memory corruption
in the library functions of qmail 1.03.
For reference see [1] [2].

Some of the qmail vulnerabilities (integer overflows and negative index???)
are present in djbdns 1.05.

For example in alloc.c of djbdns:
/*@...l@...*@out@...har *alloc(n)
unsigned int n;
  char *x;
  n = ALIGNMENT + n - (n & (ALIGNMENT - 1)); /* XXX: could overflow */

This clearly overflows for n= -1 for example.

It is natural to write an integer overflow, but
documenting easy to fix security bug is beyond
our understanding.

Reachability of the bugs is not clear and might require
gigabytes of memory to hit the problems by encoding
integer in unary.

In addition djbns limits the memory usage by |softlimit|,
but we are not sure the limits are on all vulnerable
programs. An island of tractability could be |alloc(atoi())|
or |alloc(size * count)|

Is djbdns exploitable by any of the qmail bugs?


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.