From: W.C.A. Wijngaards <wouter@nlnetlabs.nl>
Date: Wed, 22 Jul 2026 08:18:16 +0000 (+0200)
Subject: - Fix CVE-2026-55973, 'dns-error-reporting: yes' leads to stack buffer
X-Git-Tag: release-1.25.2~5
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=96f875552023c0ccf376ebe050519f12f3371dc9;p=thirdparty%2Funbound.git

- Fix CVE-2026-55973, 'dns-error-reporting: yes' leads to stack buffer
  overflow. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
---

diff --git a/services/cache/dns.c b/services/cache/dns.c
index 98d07bc37..9fc79dad0 100644
--- a/services/cache/dns.c
+++ b/services/cache/dns.c
@@ -277,6 +277,8 @@ find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen,
 
 		/* snip off front label */
 		lablen = *qname;
+		if(lablen == 0)
+			break;
 		qname += lablen + 1;
 		qnamelen -= lablen + 1;
 	}
diff --git a/services/mesh.c b/services/mesh.c
index 8ce3dcee7..5051de9df 100644
--- a/services/mesh.c
+++ b/services/mesh.c
@@ -1654,9 +1654,9 @@ static void dns_error_reporting(struct module_qstate* qstate,
 	opt = edns_opt_list_find(qstate->edns_opts_back_in,
 		LDNS_EDNS_REPORT_CHANNEL);
 	if(!opt) return;
-	agent_domain_len = opt->opt_len;
 	agent_domain = opt->opt_data;
-	if(dname_valid(agent_domain, agent_domain_len) < 3) {
+	agent_domain_len = dname_valid(agent_domain, opt->opt_len);
+	if(agent_domain_len < 3) {
 		/* The agent domain needs to be a valid dname that is not the
 		 * root; from RFC9567. */
 		return;