CC: marketing@isc.org
MIME-Version: 1.0
X-Spam-Status: No, score=0.3 required=5.0 tests=BAYES_00,BODY_8BITS,
	HEADER_FROM_DIFFERENT_DOMAINS,HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,
	MIME_HTML_ONLY,RP_MATCHES_RCVD,UNPARSEABLE_RELAY autolearn=no
	autolearn_force=no version=3.4.0
X-Mailer: PHPMailer 5.2.7 (https://github.com/PHPMailer/PHPMailer/)
Content-Type: text/html; charset=UTF-8
Message-ID: <13e97c4fd376ee719527a7c85178b77e@www.isc.org>
Replied: Fri, 11 Jul 2014 10:01:03 +1000
Replied: Vasili Burdo <vasili.burdo@infoblox.com>
Replied: security-officer@isc.org
Replied: marketing@isc.org
Received: from rock.dv.isc.org (localhost [IPv6:::1])
	by rock.dv.isc.org (Postfix) with ESMTP id 6BE551A223FE
	for <marka@localhost>; Fri, 11 Jul 2014 09:13:18 +1000 (EST)
Received: from zimbra.isc.org [149.20.0.17]
	by rock.dv.isc.org with IMAP (fetchmail-6.3.22)
	for <marka@localhost> (single-drop); Fri, 11 Jul 2014 09:13:18 +1000 (EST)
Received: from zmx1.isc.org (LHLO zmx1.isc.org) (149.20.0.20) by
 zmail1.isc.org with LMTP; Thu, 10 Jul 2014 16:43:25 +0000 (UTC)
Received: from zmx1.isc.org (localhost [127.0.0.1])
	by zmx1.isc.org (Postfix) with ESMTP id D619B160067;
	Thu, 10 Jul 2014 16:51:44 +0000 (UTC)
Received: from mx.pao1.isc.org (mx.pao1.isc.org [149.20.64.53])
	by zmx1.isc.org (Postfix) with ESMTPS id D0C2B160052
	for <security@zimbra.isc.org>; Thu, 10 Jul 2014 16:51:44 +0000 (UTC)
Received: from iscwebprod.isc.org (iscwebprod.isc.org [IPv6:2001:4f8:1:d::16])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(Client did not present a certificate)
	by mx.pao1.isc.org (Postfix) with ESMTPS id 1AFED3493B1
	for <security-officer@isc.org>; Thu, 10 Jul 2014 16:43:25 +0000 (UTC)
	(envelope-from www@iscwebprod.isc.org)
Received: from www (uid 80)
	(envelope-from www@iscwebprod.isc.org)
	id 7b7e66
	by iscwebprod.isc.org (DragonFly Mail Agent v0.7);
	Thu, 10 Jul 2014 16:45:35 +0000
Delivered-To: marka@localhost.dv.isc.org
Subject: BIND 9.9.2 - Bug in isc_print_vsnprintf() for '%llu' format
Return-Path: <www@isc.org>
X-Original-To: marka@localhost
X-Priority: 3
Date: Thu, 10 Jul 2014 16:45:35 +0000
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on mx.pao1.isc.org
To: security-officer@isc.org
Content-Transfer-Encoding: 8bit
From: Vasili Burdo <vasili.burdo@infoblox.com>
X-RT-Original-Encoding: utf-8
Content-Length: 2757

<h3>Bug Report from www.isc.org:</h3>
<ul>
<li><strong>Name:</strong> Vasili Burdo</li>
<li><strong>Email:</strong> vasili.burdo@infoblox.com</li>
<li><strong>Software Version:</strong> BIND 9.9.2</li>
<li><strong>OS:</strong> Linux</li>
<li><strong>Subject:</strong>Bug in isc_print_vsnprintf() for &#039;%llu&#039; format</li>
</ul>
<h4>Bug Detail</h4>
<p>Hi,</p>
<p>This bug reveals itself when I tried to printf() very large &quot;long long&quot; number in decimal &#8211; any number larger than 0xFFFFFFFF. It returns garbage, but does not crash.</p>
<p>This behavior is caused by incorrect buffer termination in file &#039;bind9/lib/isc/print.c&#039; at line 320. Here:<br />
&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;<br />
file: lib/isc/print.c<br />
299            case &#039;u&#039;:<br />
300                if (q)<br />
301                    tmpui = va_arg(ap, isc_uint64_t);<br />
302                else if (l)<br />
303                    tmpui = va_arg(ap, unsigned long int);<br />
304                else<br />
305                    tmpui = va_arg(ap, unsigned int);<br />
306                if (tmpui &lt;= 0xffffffffU)<br />
307                    sprintf(buf, &quot;%lu&quot;,<br />
308                        (unsigned long)tmpui);<br />
309                else {<br />
310                    unsigned long mid;<br />
311                    unsigned long lo;<br />
312                    unsigned long hi;<br />
313                    lo = tmpui % 1000000000;<br />
314                    tmpui /= 1000000000;<br />
315                    mid = tmpui % 1000000000;<br />
316                    hi = tmpui / 1000000000;<br />
317                    if (hi != 0)<br />
318                        sprintf(buf, &quot;%lu&quot;, hi);<br />
319                    else<br />
320                        buf[0] = &#039;\n&#039;; //&lt;&#8211; BUG is HERE. To fix, replace &#039;\n&#039; with &#039;\0&#039;<br />
321                    sprintf(buf + strlen(buf), &quot;%lu&quot;, mid);<br />
322                    sprintf(buf + strlen(buf), &quot;%lu&quot;, lo);<br />
323                }<br />
324                goto printint;<br />
&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;</p>
<p>As ,you see, this is buffer overrun, caused by incorrect buffer termination.</p>
<p>Please, let me know if you&#039;re going to fix it.<br />
If I will not get an answer unitl Aug 1st, I&#039;ll report it elsewhere.</p>
<p>---</p>
<p>This email was received through isc.org Bug Submission Form<br />
<br />All information within this email is considered confidential and for internal use only.</p>