dnsmasq

wt/dnsmasq

0 Fork 0

mirror of http://thekelleys.org.uk/git/dnsmasq.git synced 2026-10-18 11:09:36 +00:00

T

Michalis Vasileiadis 45771dc92c Fix OOB writes in contrib/leasequesry/leasequery.c

Thanks to Michalis Vasileiadis for spotting this.

print_mac() writes each MAC byte to its output buffer with unbounded
sprintf and is called from main() with pkt.header.hlen straight out
of a BOOTREPLY. hlen is an attacker-controlled uint8_t (up to 255),
each byte expands to up to 3 chars, and the destination is a 500-byte
stack buffer. A malicious leasequery server that echoes the client's
transaction ID and replies with DHCPLEASEACTIVE and an oversized
hlen overflows that stack buffer.

The patch caps len inside print_mac at DHCP_CHADDR_MAX (16), which is
the actual size of chaddr in the BOOTP header and an upper bound on
any legitimate hardware-address length. The other in-file caller of
print_mac already clamps its length argument to 14 before the call,
so this change is local to the vulnerable path.

2026-05-30 15:58:52 +01:00

bld

Remove hash-questions.c - no longer required.

2024-11-02 21:29:47 +00:00

contrib

Fix OOB writes in contrib/leasequesry/leasequery.c

2026-05-30 15:58:52 +01:00

dbus

Allow configuring filter-A/AAAA via dbus.

2023-03-08 15:35:05 +00:00

logo

tweak favicon