]> Cypherpunks repositories - gostls13.git/commit
net: verify results from Lookup* are valid domain names
authorRoland Shoemaker <roland@golang.org>
Mon, 17 May 2021 17:06:51 +0000 (10:06 -0700)
committerRoland Shoemaker <roland@golang.org>
Mon, 24 May 2021 22:27:31 +0000 (22:27 +0000)
commitc89f1224a544cde464fcb86e78ebb0cc97eedba2
treec647cfa5028c6a01cd039aaf2169eff81f07e87e
parent08a8fa9c471603c7ec44895392c6bfa31a8ddcb6
net: verify results from Lookup* are valid domain names

For the methods LookupCNAME, LookupSRV, LookupMX, LookupNS, and
LookupAddr check that the returned domain names are in fact valid DNS
names using the existing isDomainName function.

Thanks to Philipp Jeitner and Haya Shulman from Fraunhofer SIT for
reporting this issue.

Fixes #46241
Fixes CVE-2021-33195

Change-Id: Icf231acd93178a3b6aec3f178cff7e693f74ef8c
Reviewed-on: https://go-review.googlesource.com/c/go/+/320949
Trust: Roland Shoemaker <roland@golang.org>
Trust: Katie Hockman <katie@golang.org>
Run-TryBot: Roland Shoemaker <roland@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
src/net/dnsclient_unix_test.go
src/net/lookup.go