From 9dd370ba0475f802a4907e428d8468d29fd6fc28 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Tue, 1 Sep 2026 17:21:45 +0200
Subject: [PATCH] - Fix LOC RR parse to avoid double to uint32 cast overflow.  
 Thanks to Qifan Zhang, Palo Alto Networks, for the report.

---
 doc/Changelog    |  2 ++
 sldns/str2wire.c | 17 +++++++++++++++--
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/doc/Changelog b/doc/Changelog
index d4516b5c4..7d7c98202 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,5 +1,7 @@
 1 September 2026: Wouter
 	- Fix to allow block_a and other local-zone types in a view.
+	- Fix LOC RR parse to avoid double to uint32 cast overflow.
+	  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 
 26 August 2026: Wouter
 	- Fix notify for auth-zone during initial start up. It
diff --git a/sldns/str2wire.c b/sldns/str2wire.c
index d2c44980c..91ad42223 100644
--- a/sldns/str2wire.c
+++ b/sldns/str2wire.c
@@ -2304,6 +2304,8 @@ int sldns_str2wire_loc_buf(const char* str, uint8_t* rd, size_t* len)
 
 	if (isdigit((unsigned char) *my_str)) {
 		s = strtod(my_str, &my_str);
+		if(s > 60.0)
+			return LDNS_WIREPARSE_ERR_SYNTAX;
 	}
 
 	/* skip blanks before northerness */
@@ -2362,6 +2364,8 @@ north:
 
 	if (isdigit((unsigned char) *my_str)) {
 		s = strtod(my_str, &my_str);
+		if(s > 60.0)
+			return LDNS_WIREPARSE_ERR_SYNTAX;
 	}
 
 	/* skip blanks before easterness */
@@ -2394,8 +2398,17 @@ east:
 		longitude = equator - longitude;
 	}
 
-	altitude = (uint32_t)(strtod(my_str, &my_str)*100.0 +
-		10000000.0 + 0.5);
+	while (isblank((unsigned char) *my_str)) {
+		my_str++;
+	}
+
+	/* altitude */
+	if(!(isdigit((unsigned char) *my_str) || *my_str == '-'))
+		return LDNS_WIREPARSE_ERR_SYNTAX;
+	s = strtod(my_str, &my_str);
+	if(s < -100000.0 || s > 42849672.95)
+		return LDNS_WIREPARSE_ERR_SYNTAX;
+	altitude = (uint32_t)(s*100.0 + 10000000.0 + 0.5);
 	if (*my_str == 'm' || *my_str == 'M') {
 		my_str++;
 	}