[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [oss-security] Polipo: denial-of-service using range



How did you produce this? I can't seem to reproduce with the original
PoC script. Running it, polipo outputs:

Empty DNS name.
Host (unknown) lookup failed: empty name (22).

The script outputs:

HTTP/1.1 504 Host (unknown) lookup failed: empty name
Connection: keep-alive
Date: Sun, 01 Aug 2021 18:07:07 GMT
Content-Type: text/html
Content-Length: 515
Expires: 0
Cache-Control: no-cache
Pragma: no-cache

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd";>
<html><head>
<title>Proxy error: 504 Host (unknown) lookup failed: empty name.</title>
</head><body>
<h1>504 Host (unknown) lookup failed: empty name</h1>
<p>The following error occurred while trying to access <strong>http://</strong>:<br><br>
<strong>504 Host (unknown) lookup failed: empty name</strong></p>
<hr>Generated Sun, 01 Aug 2021 13:07:07 CDT by Polipo on <em>localhost:8123</em>.
</body></html>


Fixing the script to GET a real website shows a bunch of memory alignment
issues, but no heap overflow as far as I can tell:

dns.c:1467:5: runtime error: store to misaligned address 0x7ffe1de13c69 for type 'short unsigned int', which requires 2 byte alignment
0x7ffe1de13c69: note: pointer points here
 63 6f 6d  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00
              ^
dns.c:1468:5: runtime error: store to misaligned address 0x7ffe1de13c6b for type 'short unsigned int', which requires 2 byte alignment
0x7ffe1de13c6b: note: pointer points here
 6d  00 00 01 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00
              ^
dns.c:1554:5: runtime error: load of misaligned address 0x7ffe1de13b69 for type 'short unsigned int', which requires 2 byte alignment
0x7ffe1de13b69: note: pointer points here
 63 6f 6d  00 00 01 00 01 c0 0c 00  01 00 01 00 00 fe a7 00  04 5d b8 d8 22 7f 00 00  50 3c e1 1d fe
              ^
dns.c:1555:5: runtime error: load of misaligned address 0x7ffe1de13b6b for type 'short unsigned int', which requires 2 byte alignment
0x7ffe1de13b6b: note: pointer points here
 6d  00 00 01 00 01 c0 0c 00  01 00 01 00 00 fe a7 00  04 5d b8 d8 22 7f 00 00  50 3c e1 1d fe 7f 00
              ^
dns.c:1596:9: runtime error: load of misaligned address 0x7ffe1de13b6f for type 'short unsigned int', which requires 2 byte alignment
0x7ffe1de13b6f: note: pointer points here
 00 01 c0 0c 00  01 00 01 00 00 fe a7 00  04 5d b8 d8 22 7f 00 00  50 3c e1 1d fe 7f 00 00  22 3d 00
             ^
dns.c:1596:9: runtime error: load of misaligned address 0x7ffe1de13b71 for type 'short unsigned int', which requires 2 byte alignment
0x7ffe1de13b71: note: pointer points here
 c0 0c 00  01 00 01 00 00 fe a7 00  04 5d b8 d8 22 7f 00 00  50 3c e1 1d fe 7f 00 00  22 3d 00 00 40
              ^
dns.c:1596:9: runtime error: load of misaligned address 0x7ffe1de13b73 for type 'unsigned int', which requires 4 byte alignment
0x7ffe1de13b73: note: pointer points here
 00  01 00 01 00 00 fe a7 00  04 5d b8 d8 22 7f 00 00  50 3c e1 1d fe 7f 00 00  22 3d 00 00 40 60 00
              ^
dns.c:1596:9: runtime error: load of misaligned address 0x7ffe1de13b77 for type 'short unsigned int', which requires 2 byte alignment
0x7ffe1de13b77: note: pointer points here
 00 00 fe a7 00  04 5d b8 d8 22 7f 00 00  50 3c e1 1d fe 7f 00 00  22 3d 00 00 40 60 00 00  6b 3c e1
             ^

Attachment: signature.asc
Description: PGP signature