mirror of
http://thekelleys.org.uk/git/dnsmasq.git
synced 2026-10-28 12:40:47 +00:00
Simon Kelley
145abca7f6
There are a couple of instances in the DNSSEC validation code where the code steps along a DNS name to remove some number if left-hand labels and replace them with * to make a wildcard. The name then gets passed to to_wire() to translate it in-place to the wire format. If external parameters dictate that all the labels are removed, and the name is of exactly the maximum size, then this causes to_wire() to overwrite the buffer by one byte. Having created the wildcard, move it to the start of the buffer to avoid this problem. Thanks to Lucas Celant <lcelant@redhat.com> for spotting this. CVE-2026-93011 may apply.