From: Mark Andrews <marka@isc.org>
Date: Wed, 29 Jul 2026 03:30:47 +0000 (+1000)
Subject: Address out of bounds memory read in dnstap-read
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=69d477fffb18b89878ca49e4a3f059ce98f8b489;p=thirdparty%2Fbind9.git

Address out of bounds memory read in dnstap-read

If dnstap-read is processing a malformed file it could read
past the end of the address buffer in yaml mode.  This has
been fixed.
---

diff --git a/bin/tools/dnstap-read.c b/bin/tools/dnstap-read.c
index 4a382f2bb3..360c889178 100644
--- a/bin/tools/dnstap-read.c
+++ b/bin/tools/dnstap-read.c
@@ -187,6 +187,18 @@ cleanup:
 	}
 }
 
+static void
+print_ip(ProtobufCBinaryData *ip, const char *label) {
+	char buf[sizeof("xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:255.255.255.255")];
+	if (ip->len == 4 || ip->len == 16) {
+		if (inet_ntop(ip->len == 4 ? AF_INET : AF_INET6, ip->data, buf,
+			      sizeof(buf)) != NULL)
+		{
+			printf("  %s: \"%s\"\n", label, buf);
+		}
+	}
+}
+
 static void
 print_yaml(dns_dtdata_t *dt) {
 	Dnstap__Dnstap *frame = dt->frame;
@@ -273,20 +285,14 @@ print_yaml(dns_dtdata_t *dt) {
 
 	if (m->has_query_address) {
 		ProtobufCBinaryData *ip = &m->query_address;
-		char buf[100];
 
-		(void)inet_ntop(ip->len == 4 ? AF_INET : AF_INET6, ip->data,
-				buf, sizeof(buf));
-		printf("  query_address: \"%s\"\n", buf);
+		print_ip(ip, "query_address");
 	}
 
 	if (m->has_response_address) {
 		ProtobufCBinaryData *ip = &m->response_address;
-		char buf[100];
 
-		(void)inet_ntop(ip->len == 4 ? AF_INET : AF_INET6, ip->data,
-				buf, sizeof(buf));
-		printf("  response_address: \"%s\"\n", buf);
+		print_ip(ip, "response_address");
 	}
 
 	if (m->has_query_port) {