conf: reject line breaks in DNS SRV domain and target

The <dns><srv> domain and target attributes flow through the same
dnsmasq configuration emitter as TXT values, written into srv-host=
lines. Like the TXT value they accept XML numeric character
references for LF and CR and are not otherwise constrained, unlike
service and protocol which already have allow-lists. An embedded
line break ends the srv-host= directive and begins a new one.

Reject LF and CR in the SRV domain and target during XML parsing,
reusing the helper added for TXT values.

CVE-2026-61477

Fixes: 6612d1adb794 ("network: fix problems with SRV records")
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>

diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c
index 307ab0ae24ab95cef9be3526bbc360972338c54d..8eba1321d63b1f549ddd382c8e0ab4b8b0d8e7dd 100644 (file)
--- a/src/conf/network_conf.c
+++ b/src/conf/network_conf.c
@@ -792,6 +792,10 @@ virNetworkDNSSrvDefParseXML(const char *networkName,
     def->domain = virXMLPropString(node, "domain");
     def->target = virXMLPropString(node, "target");
 
+    if (virNetworkDNSDefCheckLineBreaks("SRV", "domain", def->domain) < 0 ||
+        virNetworkDNSDefCheckLineBreaks("SRV", "target", def->target) < 0)
+        goto error;
+
     ret = virXPathUInt("string(./@port)", ctxt, &def->port);
     if (ret >= 0 && !def->target) {
         virReportError(VIR_ERR_XML_DETAIL,