- Fix CVE-2026-56444, Degradation of resolution service when

  'discard-timeout' and 'serve-expired-client-timeout' are combined in
  unusual configuration. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report. In addition, thanks to Xin Wang, Jiapeng Li,
  and Jiajia Liu, Northwestern Polytechnical University, for also
  reporting this issue. In addition, thanks to Haruki Oyama (Waseda
  University), for also reporting this issue.

diff --git a/services/mesh.c b/services/mesh.c
index 5051de9df6dd4c3d47fb075d1c04daeac975c2b7..99361b17f9641232e9013dde50d5845e91626330 100644 (file)
--- a/services/mesh.c
+++ b/services/mesh.c
@@ -2568,9 +2568,10 @@ mesh_serve_expired_callback(void* arg)
                log_dns_msg("Serve expired lookup", &qstate->qinfo, msg->rep);
 
        for(r = mstate->reply_list; r; r = r->next) {
-               struct timeval old;
-               timeval_subtract(&old, mstate->s.env->now_tv, &r->start_time);
-               if(mstate->s.env->cfg->discard_timeout != 0 &&
+               if(mesh_is_udp(r)) {
+                   struct timeval old;
+                   timeval_subtract(&old, mstate->s.env->now_tv, &r->start_time);
+                   if(mstate->s.env->cfg->discard_timeout != 0 &&
                        ((int)old.tv_sec)*1000+((int)old.tv_usec)/1000 >
                        mstate->s.env->cfg->discard_timeout) {
                        /* Drop the reply, it is too old */
@@ -2590,8 +2591,11 @@ mesh_serve_expired_callback(void* arg)
                                doq_stream_remove_mesh_state(r->query_reply.doq_stream);
                        comm_point_drop_reply(&r->query_reply);
                        mstate->reply_list = reply_list;
+                       log_assert(mstate->s.env->mesh->num_reply_addrs > 0);
+                       mstate->s.env->mesh->num_reply_addrs--;
                        mstate->s.env->mesh->num_queries_discard_timeout++;
                        continue;
+                   }
                }
 
                i++;