- Fix CVE-2026-56416, Possible heap buffer overflow when validator

  canonicalizes RDATA that contains domain name. Thanks to Qifan
  Zhang, Palo Alto Networks, for the report.

diff --git a/util/data/msgparse.c b/util/data/msgparse.c
index 7b2de102efa8b847b07c68937fd9a98899c24e94..4be1a72dcb5abc68ff0aa6ef0e7a4d69983cfc17 100644 (file)
--- a/util/data/msgparse.c
+++ b/util/data/msgparse.c
@@ -687,6 +687,9 @@ calc_size(sldns_buffer* pkt, uint16_t type, struct rr_parse* rr)
                        }
                        rdf++;
                }
+               /* rdata ended before all _dname_count names were seen */
+               if(count != 0)
+                       return 0; /* the rdata is too short. */
        }
        /* remaining rdata */
        rr->size += pkt_len;

diff --git a/validator/val_sigcrypt.c b/validator/val_sigcrypt.c
index 46e6ac16b7d70e3d926b2d4f05e67151ff7393f3..16c01d2ee37256d76cc0e2d45441cd0ab3402f34 100644 (file)
--- a/validator/val_sigcrypt.c
+++ b/validator/val_sigcrypt.c
@@ -1094,6 +1094,7 @@ canonicalize_rdata(sldns_buffer* buf, struct ub_packed_rrset_key* rrset,
        size_t len)
 {
        uint8_t* datstart = sldns_buffer_current(buf)-len+2;
+       size_t firstlen;
        switch(ntohs(rrset->rk.type)) {
                case LDNS_RR_TYPE_NXT: 
                case LDNS_RR_TYPE_NS:
@@ -1113,8 +1114,9 @@ canonicalize_rdata(sldns_buffer* buf, struct ub_packed_rrset_key* rrset,
                case LDNS_RR_TYPE_SOA:
                        /* two names after another */
                        query_dname_tolower(datstart);
-                       query_dname_tolower(datstart + 
-                               dname_valid(datstart, len-2));
+                       firstlen = dname_valid(datstart, len-2);
+                       if(firstlen && firstlen < len-2)
+                               query_dname_tolower(datstart + firstlen);
                        return;
                case LDNS_RR_TYPE_RT:
                case LDNS_RR_TYPE_AFSDB:
@@ -1141,8 +1143,9 @@ canonicalize_rdata(sldns_buffer* buf, struct ub_packed_rrset_key* rrset,
                                return;
                        datstart += 2;
                        query_dname_tolower(datstart);
-                       query_dname_tolower(datstart + 
-                               dname_valid(datstart, len-2-2));
+                       firstlen = dname_valid(datstart, len-2-2);
+                       if(firstlen && firstlen < len-2-2)
+                               query_dname_tolower(datstart + firstlen);
                        return;
                case LDNS_RR_TYPE_NAPTR:
                        if(len < 2+4)