From 29f8712f028b4ac40d2e8668bff83e6c7adb14af Mon Sep 17 00:00:00 2001 From: Simon Kelley Date: Sun, 10 May 2026 21:47:12 +0100 Subject: [PATCH] Fix OOB read/write of rr_status. Crafted packets can write zeros outside the limits of the rr_status array, causing a crash and DoS. Thanks to Haiyang Huang for finding and reprting this. --- src/rfc1035.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/rfc1035.c b/src/rfc1035.c index 040ec5e..35f12ed 100644 --- a/src/rfc1035.c +++ b/src/rfc1035.c @@ -498,7 +498,7 @@ int do_doctor(struct dns_header *header, size_t qlen, char *namebuff) header->hb3 &= ~HB3_AA; #ifdef HAVE_DNSSEC /* remove validated flag from this RR, since we changed it! */ - if (option_bool(OPT_DNSSEC_VALID) && i < ntohs(header->ancount)) + if (option_bool(OPT_DNSSEC_VALID) && i < daemon->rr_status_sz && i < ntohs(header->ancount)) daemon->rr_status[i] = 0; #endif done = 1; @@ -610,7 +610,9 @@ static int find_soa(struct dns_header *header, size_t qlen, char *name, int *sub addr.rrblock.datalen += 20; #ifdef HAVE_DNSSEC - if (option_bool(OPT_DNSSEC_VALID) && daemon->rr_status[i + ntohs(header->ancount)] != 0) + if (option_bool(OPT_DNSSEC_VALID) && + i + ntohs(header->ancount) < daemon->rr_status_sz && + daemon->rr_status[i + ntohs(header->ancount)] != 0) { secflag = F_DNSSECOK;