[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20260226133519.GI3520958@port70.net>
Date: Thu, 26 Feb 2026 14:35:19 +0100
From: Szabolcs Nagy <nsz@...t70.net>
To: Liam Wachter <liam@...mmetric.re>
Cc: musl@...ts.openwall.com
Subject: Re: [PATCH] dns: fix nameserver OOB read in IPv6-disabled
fallback
* Liam Wachter <liam@...mmetric.re> [2026-02-26 08:51:09 +0100]:
> In __res_msend_rc(), the IPv6-disabled fallback check uses conf->ns[nns]
> inside a loop controlled by i, so it tests a fixed slot instead of
> walking configured nameservers. This reads one past the array's size.
>
> Use conf->ns[i] so the loop correctly detects whether all configured
> nameservers are IPv6-only.
>
the patch looks good.
OOB access reads value != AF_INET6 under the assumption
that the compiler does not consider separate TUs together,
so the behaviour is mostly i!=nns i.e. the check was
ineffective. i==nns only happens if uninitialized read
from conf->ns[] happens to be AF_INET6 (should be rare).
so does not look exploitable.
> ---
> src/network/res_msend.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/src/network/res_msend.c b/src/network/res_msend.c
> index fcb52513..51d42ecb 100644
> --- a/src/network/res_msend.c
> +++ b/src/network/res_msend.c
> @@ -124,7 +124,7 @@ int __res_msend_rc(int nqueries, const unsigned char
> *const *queries,
>
> /* Handle case where system lacks IPv6 support */
> if (fd < 0 && family == AF_INET6 && errno == EAFNOSUPPORT) {
> - for (i=0; i<nns && conf->ns[nns].family == AF_INET6; i++);
> + for (i=0; i<nns && conf->ns[i].family == AF_INET6; i++);
> if (i==nns) {
> pthread_setcancelstate(cs, 0);
> return -1;
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
