From: W.C.A. Wijngaards <wouter@nlnetlabs.nl>
Date: Wed, 22 Jul 2026 08:19:28 +0000 (+0200)
Subject: - Fix CVE-2026-56416, Possible heap buffer overflow when validator
X-Git-Tag: release-1.25.2~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4b1635e19406fd8040806f0fa4a4488c003b5d0d;p=thirdparty%2Funbound.git

- Fix CVE-2026-56416, Possible heap buffer overflow when validator
  canonicalizes RDATA that contains domain name. Thanks to Qifan
  Zhang, Palo Alto Networks, for the report.
---

diff --git a/util/data/msgparse.c b/util/data/msgparse.c
index 7b2de102e..4be1a72dc 100644
--- a/util/data/msgparse.c
+++ b/util/data/msgparse.c
@@ -687,6 +687,9 @@ calc_size(sldns_buffer* pkt, uint16_t type, struct rr_parse* rr)
 			}
 			rdf++;
 		}
+		/* rdata ended before all _dname_count names were seen */
+		if(count != 0)
+			return 0; /* the rdata is too short. */
 	}
 	/* remaining rdata */
 	rr->size += pkt_len;
diff --git a/validator/val_sigcrypt.c b/validator/val_sigcrypt.c
index 46e6ac16b..16c01d2ee 100644
--- a/validator/val_sigcrypt.c
+++ b/validator/val_sigcrypt.c
@@ -1094,6 +1094,7 @@ canonicalize_rdata(sldns_buffer* buf, struct ub_packed_rrset_key* rrset,
 	size_t len)
 {
 	uint8_t* datstart = sldns_buffer_current(buf)-len+2;
+	size_t firstlen;
 	switch(ntohs(rrset->rk.type)) {
 		case LDNS_RR_TYPE_NXT: 
 		case LDNS_RR_TYPE_NS:
@@ -1113,8 +1114,9 @@ canonicalize_rdata(sldns_buffer* buf, struct ub_packed_rrset_key* rrset,
 		case LDNS_RR_TYPE_SOA:
 			/* two names after another */
 			query_dname_tolower(datstart);
-			query_dname_tolower(datstart + 
-				dname_valid(datstart, len-2));
+			firstlen = dname_valid(datstart, len-2);
+			if(firstlen && firstlen < len-2)
+				query_dname_tolower(datstart + firstlen);
 			return;
 		case LDNS_RR_TYPE_RT:
 		case LDNS_RR_TYPE_AFSDB:
@@ -1141,8 +1143,9 @@ canonicalize_rdata(sldns_buffer* buf, struct ub_packed_rrset_key* rrset,
 				return;
 			datstart += 2;
 			query_dname_tolower(datstart);
-			query_dname_tolower(datstart + 
-				dname_valid(datstart, len-2-2));
+			firstlen = dname_valid(datstart, len-2-2);
+			if(firstlen && firstlen < len-2-2)
+				query_dname_tolower(datstart + firstlen);
 			return;
 		case LDNS_RR_TYPE_NAPTR:
 			if(len < 2+4)