wt/dnsmasq
1
0 Fork 0
mirror of http://thekelleys.org.uk/git/dnsmasq.git synced 2026-10-27 12:31:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix OOB read/write of rr_status.

Browse Source 
Crafted packets can write zeros outside the limits of the rr_status
array, causing a crash and DoS.

Thanks to Haiyang Huang for finding and reprting this.
This commit is contained in:
Simon Kelley committed 2026-05-10 21:47:12 +01:00
1 parent 0450f9e28a
commit 29f8712f02
1 file changed
+4 -2
Download Patch File Download Diff File Expand all files Collapse all files
src/rfc1035.c
+4 -2
View File
@@ -498,7 +498,7 @@ int do_doctor(struct dns_header *header, size_t qlen, char *namebuff)
header->hb3 &= ~HB3_AA;
#ifdef HAVE_DNSSEC
/* remove validated flag from this RR, since we changed it! */
if (option_bool(OPT_DNSSEC_VALID) && i < ntohs(header->ancount))
if (option_bool(OPT_DNSSEC_VALID) && i < daemon->rr_status_sz && i < ntohs(header->ancount))
daemon->rr_status[i] = 0;
#endif
done = 1;
@@ -610,7 +610,9 @@ static int find_soa(struct dns_header *header, size_t qlen, char *name, int *sub
addr.rrblock.datalen += 20;
#ifdef HAVE_DNSSEC
if (option_bool(OPT_DNSSEC_VALID) && daemon->rr_status[i + ntohs(header->ancount)] != 0)
if (option_bool(OPT_DNSSEC_VALID) &&
i + ntohs(header->ancount) < daemon->rr_status_sz &&
daemon->rr_status[i + ntohs(header->ancount)] != 0)
{
secflag = F_DNSSECOK;