From 14094e88beca519c53151184cc4553656672b54f Mon Sep 17 00:00:00 2001 From: do litli Date: Sat, 9 May 2026 22:21:18 +0100 Subject: [PATCH] Fix buffer OOB read in find_soa() In find_soa() extract_name() is called with extrabytes=0 when parsing NS record names, which means it only validates that the DNS name fits within the packet but does not check that 10 additional bytes exist for the type/class/TTL/rdlen fixed fields. Lines 546-549 then unconditionally read these 10 bytes via GETSHORT/GETLONG macros. An attacker controlling a DNS zone can craft a NXDOMAIN response where the NS record name extends to the packet boundary, causing a 10-byte out-of-bounds read past the valid packet data (CWE-125, CVSS 5.3 Medium). The read stays within the over-allocated packet buffer in default configurations, limiting crash risk, but accesses data outside the logical packet boundary. Under certain conditions, the overread may access stale heap data from prior transactions. The fix is straightforward: change the extrabytes argument from 0 to 10, consistent with other call sites in the same file. Credit is due to do litli for finding this problem. --- src/rfc1035.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/rfc1035.c b/src/rfc1035.c index 0afd0d3..75c79f7 100644 --- a/src/rfc1035.c +++ b/src/rfc1035.c @@ -545,7 +545,7 @@ static int find_soa(struct dns_header *header, size_t qlen, char *name, int *sub for (i = 0; i < ntohs(header->nscount); i++) { - if (!extract_name(header, qlen, &p, daemon->workspacename, EXTR_NAME_EXTRACT, 0)) + if (!extract_name(header, qlen, &p, daemon->workspacename, EXTR_NAME_EXTRACT, 10)) return 0; /* bad packet */ GETSHORT(qtype, p);