- Fix CVE-2026-55973, 'dns-error-reporting: yes' leads to stack buffer

  overflow. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

diff --git a/services/cache/dns.c b/services/cache/dns.c
index 98d07bc371ca571b903fe181ca85beacd467e2fa..9fc79dad012c8363d03015879e80ac21c581367a 100644 (file)
--- a/services/cache/dns.c
+++ b/services/cache/dns.c
@@ -277,6 +277,8 @@ find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen,
 
                /* snip off front label */
                lablen = *qname;
+               if(lablen == 0)
+                       break;
                qname += lablen + 1;
                qnamelen -= lablen + 1;
        }

diff --git a/services/mesh.c b/services/mesh.c
index 8ce3dcee73a83dd41bb183102e2835e54cfab1cf..5051de9df6dd4c3d47fb075d1c04daeac975c2b7 100644 (file)
--- a/services/mesh.c
+++ b/services/mesh.c
@@ -1654,9 +1654,9 @@ static void dns_error_reporting(struct module_qstate* qstate,
        opt = edns_opt_list_find(qstate->edns_opts_back_in,
                LDNS_EDNS_REPORT_CHANNEL);
        if(!opt) return;
-       agent_domain_len = opt->opt_len;
        agent_domain = opt->opt_data;
-       if(dname_valid(agent_domain, agent_domain_len) < 3) {
+       agent_domain_len = dname_valid(agent_domain, opt->opt_len);
+       if(agent_domain_len < 3) {
                /* The agent domain needs to be a valid dname that is not the
                 * root; from RFC9567. */
                return;