- Fix that dnscrypt configuration does not crash, due to

  inconsistency between secret and public keys. Also
  duplicate files are skipped. Thanks to Qifan Zhang, Palo
  Alto Networks, for the report.

diff --git a/dnscrypt/dnscrypt.c b/dnscrypt/dnscrypt.c
index 173484cdf0b10eb9a75e48df85c756b1494e4718..c4289dd68e6ce39588e998b1fd7f537c3d0af0b4 100644 (file)
--- a/dnscrypt/dnscrypt.c
+++ b/dnscrypt/dnscrypt.c
@@ -830,7 +830,14 @@ dnsc_parse_keys(struct dnsc_env *env, struct config_file *cfg)
                        if(memcmp(current_keypair->crypt_publickey,
                                env->signed_certs[c].server_publickey,
                                crypto_box_PUBLICKEYBYTES) == 0) {
-                               dnsccert *current_cert = &env->certs[cert_id++];
+                               dnsccert* current_cert;
+                               if(cert_id >= env->signed_certs_count) {
+                                       log_err("dnscrypt: secret key %s matches a cert that "
+                                               "is already bound to another key (duplicate "
+                                               "dnscrypt-secret-key?)", head->str);
+                                       return -1;
+                               }
+                               current_cert = &env->certs[cert_id++];
                                found_cert = 1;
                                current_cert->keypair = current_keypair;
                                memcpy(current_cert->magic_query,

diff --git a/doc/Changelog b/doc/Changelog
index 9cb8c1fb50a39f00afbc491f22b0002e4c9d0da8..65c5983f29a9f5ac8c27cd584be64e472630784c 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -32,7 +32,10 @@
          list does not crash later. The newly created RRset is
          linked after creation has succeeded. Thanks to Qifan Zhang,
          Palo Alto Networks, for the report.
-
+       - Fix that dnscrypt configuration does not crash, due to
+         inconsistency between secret and public keys. Also
+         duplicate files are skipped. Thanks to Qifan Zhang, Palo
+         Alto Networks, for the report.
 
 15 June 2026: Wouter
        - Fix to add `max-transfer-size` and `max-transfer-time` that

diff --git a/util/configparser.y b/util/configparser.y
index 71cb56ba9c4fbe6882e1b55396d4f4bc63b1587b..6e01b15d73dd4abf7a5ca19294fc0a8ccf74cee4 100644 (file)
--- a/util/configparser.y
+++ b/util/configparser.y
@@ -3862,10 +3862,12 @@ dnsc_dnscrypt_provider: VAR_DNSCRYPT_PROVIDER STRING_ARG
 dnsc_dnscrypt_provider_cert: VAR_DNSCRYPT_PROVIDER_CERT STRING_ARG
        {
                OUTYY(("P(dnsc_dnscrypt_provider_cert:%s)\n", $2));
-               if(cfg_strlist_find(cfg_parser->cfg->dnscrypt_provider_cert, $2))
+               if(cfg_strlist_find(cfg_parser->cfg->dnscrypt_provider_cert, $2)) {
                        log_warn("dnscrypt-provider-cert %s is a duplicate", $2);
-               if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_provider_cert, $2))
+                       free($2);
+               } else if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_provider_cert, $2)) {
                        fatal_exit("out of memory adding dnscrypt-provider-cert");
+               }
        }
        ;
 dnsc_dnscrypt_provider_cert_rotated: VAR_DNSCRYPT_PROVIDER_CERT_ROTATED STRING_ARG
@@ -3878,10 +3880,12 @@ dnsc_dnscrypt_provider_cert_rotated: VAR_DNSCRYPT_PROVIDER_CERT_ROTATED STRING_A
 dnsc_dnscrypt_secret_key: VAR_DNSCRYPT_SECRET_KEY STRING_ARG
        {
                OUTYY(("P(dnsc_dnscrypt_secret_key:%s)\n", $2));
-               if(cfg_strlist_find(cfg_parser->cfg->dnscrypt_secret_key, $2))
+               if(cfg_strlist_find(cfg_parser->cfg->dnscrypt_secret_key, $2)) {
                        log_warn("dnscrypt-secret-key: %s is a duplicate", $2);
-               if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_secret_key, $2))
+                       free($2);
+               } else if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_secret_key, $2)) {
                        fatal_exit("out of memory adding dnscrypt-secret-key");
+               }
        }
        ;
 dnsc_dnscrypt_shared_secret_cache_size: VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE STRING_ARG