wt/dnsmasq
1
0 Fork 0
mirror of http://thekelleys.org.uk/git/dnsmasq.git synced 2026-10-17 10:59:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix broken client subnet validation. CVE-2026-4893

Browse Source 
Bug report from Royce M <royce@xchglabs.com>

Location: forward.c:713, edns0.c:421

With --add-subnet enabled, process_reply() passes the OPT record
length (~23 bytes) instead of the packet length to check_source().
All internal bounds checks fail, and the function always returns 1.
ECS source validation per RFC 7871 Section 9.2 is completely bypassed.
This commit is contained in:
Simon Kelley committed 2026-05-10 21:49:40 +01:00
1 parent 10e6b5b83e
commit e3a26d092e
1 file changed
+1 -1
Download Patch File Download Diff File Expand all files Collapse all files
src/forward.c
+1 -1
View File
@@ -724,7 +724,7 @@ static size_t process_reply(struct dns_header *header, time_t now, struct server
/* Get extended RCODE. */
rcode |= sizep[2] << 4;
if (option_bool(OPT_CLIENT_SUBNET) && !check_source(header, plen, pheader, query_source))
if (option_bool(OPT_CLIENT_SUBNET) && !check_source(header, n, pheader, query_source))
{
my_syslog(LOG_WARNING, _("discarding DNS reply: subnet option mismatch"));
return 0;