Hannu NymanandHauke Mehrtens
dc04999b1f
Apply upstream patches for the recently published CVEs in dnsmasq. Source: https://thekelleys.org.uk/dnsmasq/CVE/ Reference: https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi> Link: https://github.com/openwrt/openwrt/pull/23330 [Added this to main branch first] Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
43 lines
1.2 KiB
Diff
43 lines
1.2 KiB
Diff
commit 4fdb707633afe8028118bcaf39b4882f634b5999
|
|
Author: Simon Kelley <simon@thekelleys.org.uk>
|
|
Date: Fri Apr 10 16:24:02 2026 +0100
|
|
|
|
Fix NSEC bitmap parsing infinite loop. CVE-2026-4890
|
|
|
|
Report from Royce M <royce@xchglabs.com>.
|
|
|
|
Location: dnssec.c:1290-1306, dnssec.c:1450-1463
|
|
|
|
The bitmap window iteration advances by p[1] instead of p[1]+2
|
|
(missing the 2-byte window header). With bitmap_length=0, both rdlen and p are
|
|
unchanged, causing an infinite loop and dnsmasq stops responding to all queries.
|
|
|
|
Reachable before RRSIG validation
|
|
(confirmed by the source comment at line 2125), so no valid
|
|
DNSSEC signatures are needed.
|
|
|
|
--- a/src/dnssec.c
|
|
+++ b/src/dnssec.c
|
|
@@ -1344,8 +1344,8 @@ static int prove_non_existence_nsec(stru
|
|
break; /* finished checking */
|
|
}
|
|
|
|
- rdlen -= p[1];
|
|
- p += p[1];
|
|
+ rdlen -= p[1] + 2;
|
|
+ p += p[1] + 2;
|
|
}
|
|
|
|
return 0;
|
|
@@ -1508,8 +1508,8 @@ static int check_nsec3_coverage(struct d
|
|
break; /* finished checking */
|
|
}
|
|
|
|
- rdlen -= p[1];
|
|
- p += p[1];
|
|
+ rdlen -= p[1] + 2;
|
|
+ p += p[1] + 2;
|
|
}
|
|
|
|
return 1;
|