From 96f875552023c0ccf376ebe050519f12f3371dc9 Mon Sep 17 00:00:00 2001 From: "W.C.A. Wijngaards" Date: Wed, 22 Jul 2026 10:18:16 +0200 Subject: [PATCH] - Fix CVE-2026-55973, 'dns-error-reporting: yes' leads to stack buffer overflow. Thanks to Qifan Zhang, Palo Alto Networks, for the report. --- services/cache/dns.c | 2 ++ services/mesh.c | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/services/cache/dns.c b/services/cache/dns.c index 98d07bc37..9fc79dad0 100644 --- a/services/cache/dns.c +++ b/services/cache/dns.c @@ -277,6 +277,8 @@ find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen, /* snip off front label */ lablen = *qname; + if(lablen == 0) + break; qname += lablen + 1; qnamelen -= lablen + 1; } diff --git a/services/mesh.c b/services/mesh.c index 8ce3dcee7..5051de9df 100644 --- a/services/mesh.c +++ b/services/mesh.c @@ -1654,9 +1654,9 @@ static void dns_error_reporting(struct module_qstate* qstate, opt = edns_opt_list_find(qstate->edns_opts_back_in, LDNS_EDNS_REPORT_CHANNEL); if(!opt) return; - agent_domain_len = opt->opt_len; agent_domain = opt->opt_data; - if(dname_valid(agent_domain, agent_domain_len) < 3) { + agent_domain_len = dname_valid(agent_domain, opt->opt_len); + if(agent_domain_len < 3) { /* The agent domain needs to be a valid dname that is not the * root; from RFC9567. */ return;