{"action":"closed","issue":{"url":"https://api.github.com/repos/nodejs/node/issues/8538","repository_url":"https://api.github.com/repos/nodejs/node","labels_url":"https://api.github.com/repos/nodejs/node/issues/8538/labels{/name}","comments_url":"https://api.github.com/repos/nodejs/node/issues/8538/comments","events_url":"https://api.github.com/repos/nodejs/node/issues/8538/events","html_url":"https://github.com/nodejs/node/issues/8538","id":177011758,"number":8538,"title":"dns.setServers is memory unsafe and can be used to dump core","user":{"login":"deian","id":374012,"avatar_url":"https://avatars.githubusercontent.com/u/374012?v=3","gravatar_id":"","url":"https://api.github.com/users/deian","html_url":"https://github.com/deian","followers_url":"https://api.github.com/users/deian/followers","following_url":"https://api.github.com/users/deian/following{/other_user}","gists_url":"https://api.github.com/users/deian/gists{/gist_id}","starred_url":"https://api.github.com/users/deian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deian/subscriptions","organizations_url":"https://api.github.com/users/deian/orgs","repos_url":"https://api.github.com/users/deian/repos","events_url":"https://api.github.com/users/deian/events{/privacy}","received_events_url":"https://api.github.com/users/deian/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/nodejs/node/labels/c++","name":"c++","color":"e11d21"},{"url":"https://api.github.com/repos/nodejs/node/labels/dns","name":"dns","color":"fbca04"}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-09-14T20:27:45Z","updated_at":"2016-09-21T00:00:37Z","closed_at":"2016-09-21T00:00:37Z","body":"<!--\r\nThank you for reporting an issue.\r\nPlease fill in as much of the template below as you're able.\r\n\r\nVersion: output of `node -v`\r\nPlatform: output of `uname -a` (UNIX), or version and 32 or 64-bit (Windows)\r\nSubsystem: if known, please specify affected core module name\r\n\r\nIf possible, please provide code that demonstrates the problem, keeping it as\r\nsimple and free of external dependencies as you are able.\r\n-->\r\n\r\n* **Version**: 6.5.0\r\n* **Platform**:\r\n* **Subsystem**:\r\n\r\n<!-- Enter your issue details below this comment. -->\r\n\r\n`dns.setServers` is memory unsafe and can be used to dump core.\r\n \r\nThis doesn't seem like a serious security vulnerability (hence my reporting here), but can certainly be used to cause DOS and it might be nice to have a stdlib that is memory safe.\r\n\r\n```javascript\r\nconst dns = require('dns');\r\nconst servers = [];\r\nservers[0] = '127.0.0.1';\r\nservers[2] = '0.0.0.0';\r\ndns.setServers(servers);\r\n// causes the CHECK src/cares_wrap.cc:1241 to dump core\r\n```\r\n\r\nanother variant:\r\n\r\n```javascript\r\nconst dns = require('dns');\r\nconst servers = ['127.0.0.1','192.168.1.1'];\r\nservers[3] = '127.1.0.1';\r\nservers[4] = '127.1.0.1';\r\nservers[5] = '127.1.1.1';\r\nObject.defineProperty(servers, 2, {\r\n  enumerable: true,\r\n  get: () => {\r\n    servers.length = 3;\r\n    return '0.0.0.0';\r\n  }\r\n});\r\ndns.setServers(servers);\r\n// causes the CHECK src/cares_wrap.cc:1241 to dump core\r\n```\r\nRelated to: #8539, #8537, #7902\r\n+  @mlfbrown"}}
{"actor":{"display_login":"cjihrig"}}