Hannu NymanandHauke Mehrtens
dc04999b1f
Apply upstream patches for the recently published CVEs in dnsmasq. Source: https://thekelleys.org.uk/dnsmasq/CVE/ Reference: https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi> Link: https://github.com/openwrt/openwrt/pull/23330 [Added this to main branch first] Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
27 lines
1.1 KiB
Diff
27 lines
1.1 KiB
Diff
commit fa3c8ddef6712b52f562813317e6a997e1210123
|
|
Author: Simon Kelley <simon@thekelleys.org.uk>
|
|
Date: Mon Mar 30 16:24:33 2026 +0100
|
|
|
|
Fix buffer overflow vulnerability in extract_addresses() CVE-2026-5172
|
|
|
|
Thanks to Hugo Martinez Ray for spotting this.
|
|
|
|
The value of rdlen for an RR can be a lie, allowing the
|
|
call to extract_name() at rfc1025.c:952 to advance the value of p1
|
|
past the calculated end of the record. The makes the calculation
|
|
of bytes remaining in the RR underflow to a huge number and results
|
|
in a massive heap OOB read and certain crash.
|
|
|
|
--- a/src/rfc1035.c
|
|
+++ b/src/rfc1035.c
|
|
@@ -943,7 +943,8 @@ int extract_addresses(struct dns_header
|
|
/* Name, extract it then re-encode. */
|
|
int len;
|
|
|
|
- if (!extract_name(header, qlen, &p1, name, EXTR_NAME_EXTRACT, 0))
|
|
+ /* rdlen may lie, and extract_name() advances p1 past where it says the record ends. */
|
|
+ if (!extract_name(header, qlen, &p1, name, EXTR_NAME_EXTRACT, 0) || (p1 > endrr))
|
|
{
|
|
blockdata_free(addr.rrblock.rrdata);
|
|
return 2;
|