mirror of
http://thekelleys.org.uk/git/dnsmasq.git
synced 2026-10-12 10:22:34 +00:00
朱耀辉
f90df6c532
Credit to Yaohui Zhu (朱耀辉) for finding this. CNVD-C-2026-590208 applies. Summary zone_status() (src/dnssec.c:1867 in the 2.93 release; the same construct is in current git master, 2.93-29-gad92083) computes &name[name_start-2] in its backtrack loop without checking that name_start >= 2. When name_start == 1 the loop starts at name[-1] and dereferences it immediately; the guard (p != name) can never fire for p < name, so the scan walks backwards through the heap until it finds a '.' byte or hits an unmapped page. Under ASAN this is a deterministic heap-buffer-overflow READ; on a plain build the process dies with SIGSEGV. A single, ordinary query plus one crafted upstream reply is enough. My reproducer starts the ASAN binary with --dnssec and the root trust anchor, with a mock upstream; on the first query the mock answers with a captured crafted reply (a response carrying RRSIG(46), NSEC(47) with an empty/root owner name, and NSEC3(50) records in the authority section) and the process crashes on the first query.