Hannu NymanandHauke Mehrtens
dc04999b1f
Apply upstream patches for the recently published CVEs in dnsmasq. Source: https://thekelleys.org.uk/dnsmasq/CVE/ Reference: https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi> Link: https://github.com/openwrt/openwrt/pull/23330 [Added this to main branch first] Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
29 lines
1.1 KiB
Diff
29 lines
1.1 KiB
Diff
commit 011a36c51438c986535a7248ed2e7f424f8e1078
|
|
Author: Simon Kelley <simon@thekelleys.org.uk>
|
|
Date: Wed Mar 25 23:16:35 2026 +0000
|
|
|
|
Fix buffer overflow in helper.c with large CLIDs. CVE-2026-4892
|
|
|
|
Bug reported bt Royce M <royce@xchglabs.com>
|
|
|
|
Location: helper.c:265-270
|
|
DHCPv6 CLIDs can be up to 65535 bytes. When --dhcp-script is configured,
|
|
the helper hex-encodes raw CLID bytes via sprintf("%.2x") into daemon->packet (5131 bytes).
|
|
A 1000-byte CLID writes ~3000 bytes. The helper process retains root privileges.
|
|
|
|
Note: log6_packet() correctly caps CLID to 100 bytes for logging, but the helper code path was missed.
|
|
|
|
--- a/src/helper.c
|
|
+++ b/src/helper.c
|
|
@@ -261,8 +261,8 @@ int create_helper(int event_fd, int err_
|
|
data.hostname_len + data.ed_len + data.clid_len, RW_READ))
|
|
continue;
|
|
|
|
- /* CLID into packet */
|
|
- for (p = daemon->packet, i = 0; i < data.clid_len; i++)
|
|
+ /* CLID into packet: limit to 100 bytes to avoid overflowing buffer. */
|
|
+ for (p = daemon->packet, i = 0; i < data.clid_len && i < 100; i++)
|
|
{
|
|
p += sprintf(p, "%.2x", buf[i]);
|
|
if (i != data.clid_len - 1)
|