- Fix CVE-2026-55990, Packet of death for a DNSCrypt misconfigured

  Unbound. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

diff --git a/dnscrypt/dnscrypt.c b/dnscrypt/dnscrypt.c
index 08f9dcb8cea769fb92b1223550b434e8174c1e2c..6f1a236ad7e53e0b9d799a647b5dda6b0d8fc113 100644 (file)
--- a/dnscrypt/dnscrypt.c
+++ b/dnscrypt/dnscrypt.c
@@ -672,6 +672,8 @@ dnsc_find_cert(struct dnsc_env* dnscenv, struct sldns_buffer* buffer)
        }
        dnscrypt_header = (struct dnscrypt_query_header *)sldns_buffer_begin(buffer);
        for (i = 0U; i < dnscenv->signed_certs_count; i++) {
+               if(!certs[i].keypair)
+                       continue;
                if (memcmp(certs[i].magic_query, dnscrypt_header->magic_query,
                    DNSCRYPT_MAGIC_HEADER_LEN) == 0) {
                        return &certs[i];
@@ -813,6 +815,7 @@ dnsc_parse_keys(struct dnsc_env *env, struct config_file *cfg)
                sizeof *env->keypairs);
        env->certs = sodium_allocarray(env->signed_certs_count,
                sizeof *env->certs);
+       memset(env->certs, 0, env->signed_certs_count * sizeof(*env->certs));
 
        cert_id = 0U;
        keypair_id = 0U;
@@ -973,12 +976,19 @@ dnsc_create(void)
 int
 dnsc_apply_cfg(struct dnsc_env *env, struct config_file *cfg)
 {
+    int nkeys;
     if(dnsc_parse_certs(env, cfg) <= 0) {
         fatal_exit("dnsc_apply_cfg: no cert file loaded");
     }
-    if(dnsc_parse_keys(env, cfg) <= 0) {
+    nkeys = dnsc_parse_keys(env, cfg);
+    if(nkeys <= 0) {
         fatal_exit("dnsc_apply_cfg: no key file loaded");
     }
+    if((size_t)nkeys < env->signed_certs_count) {
+       fatal_exit("dnsc_apply_cfg: %u dnscrypt-provider-cert file(s) have no "
+               "matching dnscrypt-secret-key",
+               (unsigned)(env->signed_certs_count - (size_t)nkeys));
+    }
     randombytes_buf(env->hash_key, sizeof env->hash_key);
     env->provider_name = cfg->dnscrypt_provider;