From 788b4e0f6c05217981b512bed4e5fea6f8855d01 Mon Sep 17 00:00:00 2001 From: Simon Kelley Date: Wed, 25 Mar 2026 23:04:08 +0000 Subject: [PATCH] Verify rdlen field in RRSIG packets. CVE-2026-4891 Bug report from Royce M This avoids crafted packets which give a value for rdlen _less_ then the space taken up by the fixed data and the signer's name and engender a negative calculated length for the signature. --- src/dnssec.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/src/dnssec.c b/src/dnssec.c index 4eb6e53..afdedf3 100644 --- a/src/dnssec.c +++ b/src/dnssec.c @@ -543,10 +543,14 @@ static int validate_rrset(time_t now, struct dns_header *header, size_t plen, in *ttl_out = ttl; } - + + /* Don't trust rdlen not to be too small and give us a negative sig_len + It has already been checked that it doesn't run us off the end + of the packet. */ + if ((sig_len = rdlen - (p - psav)) <= 0) + return STAT_BOGUS; + sig = p; - sig_len = rdlen - (p - psav); - nsigttl = htonl(orig_ttl); hash->update(ctx, 18, psav);