mirror of
http://thekelleys.org.uk/git/dnsmasq.git
synced 2026-10-15 10:39:35 +00:00
do litli
14094e88be
In find_soa() extract_name() is called with extrabytes=0 when parsing NS record names, which means it only validates that the DNS name fits within the packet but does not check that 10 additional bytes exist for the type/class/TTL/rdlen fixed fields. Lines 546-549 then unconditionally read these 10 bytes via GETSHORT/GETLONG macros. An attacker controlling a DNS zone can craft a NXDOMAIN response where the NS record name extends to the packet boundary, causing a 10-byte out-of-bounds read past the valid packet data (CWE-125, CVSS 5.3 Medium). The read stays within the over-allocated packet buffer in default configurations, limiting crash risk, but accesses data outside the logical packet boundary. Under certain conditions, the overread may access stale heap data from prior transactions. The fix is straightforward: change the extrabytes argument from 0 to 10, consistent with other call sites in the same file. Credit is due to do litli for finding this problem.