From 9eb0757da96dc2eb1164ee611637c396c2d1307e Mon Sep 17 00:00:00 2001 From: Toliak Purple Date: Tue, 21 Apr 2026 21:49:35 +0100 Subject: [PATCH] Fix crash with mal-formed config option. Reproduction Steps. Both commands cause a segmentation fault: ``` dnsmasq --interface-name=, dnsmasq --dynamic-host=,::, ``` Stack Trace (ASAN, v2.90) ``` ==1817==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f0203d22845 bp 0x7ffc3316b920 sp 0x7ffc3316b0a0 T0) ==1817==The signal is caused by a READ memory access. ==1817==Hint: address points to the zero page. #0 0x7f0203d22845 in __interceptor_strncmp ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:488 #1 0x5563361feeb3 in iface_allowed /opt/dnsmasq/src/network.c:361 #2 0x556336203aca in iface_allowed_v6 /opt/dnsmasq/src/network.c:622 #3 0x55633625cc4c in iface_enumerate /opt/dnsmasq/src/netlink.c:291 #4 0x55633620573c in enumerate_interfaces /opt/dnsmasq/src/network.c:836 #5 0x55633615c3fe in main /opt/dnsmasq/src/dnsmasq.c:367 ``` The fault occurs due to a null-pointer dereference in iface_allowed() at line 361: ``` if (strncmp(label, int_name->intr, IF_NAMESIZE) == 0) //// here int_name->intr is NULL ``` That occurs due to a null-pointer assignment in the option.c at line 4856: ``` new->intr = opt_string_alloc(arg); //// if arg is empty string, the opt_string_alloc will return NULL ``` --- src/option.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/option.c b/src/option.c index 9a2d45d..b882968 100644 --- a/src/option.c +++ b/src/option.c @@ -4960,7 +4960,8 @@ err: arg = NULL; /* provoke error below */ } - if (!domain || !arg || !(new->name = canonicalise_opt(domain))) + if (!domain || !arg || !new->intr || + !(new->name = canonicalise_opt(domain))) ret_err(option == LOPT_DYNHOST ? _("bad dynamic host") : _("bad interface name"));