wt/dnsmasq
1
0 Fork 0
mirror of http://thekelleys.org.uk/git/dnsmasq.git synced 2026-10-29 12:50:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix buffer overflow in helper.c with large CLIDs. CVE-2026-4892

Browse Source 
Bug reported bt Royce M <royce@xchglabs.com>

Location: helper.c:265-270
DHCPv6 CLIDs can be up to 65535 bytes. When --dhcp-script is configured,
the helper hex-encodes raw CLID bytes via sprintf("%.2x") into daemon->packet (5131 bytes).
A 1000-byte CLID writes ~3000 bytes. The helper process retains root privileges.

Note: log6_packet() correctly caps CLID to 100 bytes for logging, but the helper code path was missed.
This commit is contained in:
Simon Kelley committed 2026-05-10 21:49:40 +01:00
1 parent 788b4e0f6c
commit 10e6b5b83e
1 file changed
+2 -2
Download Patch File Download Diff File Expand all files Collapse all files
src/helper.c
+2 -2
View File
@@ -261,8 +261,8 @@ int create_helper(int event_fd, int err_fd, uid_t uid, gid_t gid, long max_fd)
data.hostname_len + data.ed_len + data.clid_len, RW_READ))
continue;
/* CLID into packet */
for (p = daemon->packet, i = 0; i < data.clid_len; i++)
/* CLID into packet: limit to 100 bytes to avoid overflowing buffer. */
for (p = daemon->packet, i = 0; i < data.clid_len && i < 100; i++)
{
p += sprintf(p, "%.2x", buf[i]);
if (i != data.clid_len - 1)