From b087cf4a6c3dd4c323a099770a44c24812381bf4 Mon Sep 17 00:00:00 2001 From: Simon Kelley Date: Thu, 21 Nov 2024 15:28:31 +0000 Subject: [PATCH] Fix out-of-bounds heap read in order_qsort(). We only need to order two server records on the ->serial field. Literal address records are smaller and don't have this field and don't need to be ordered on it. To actually provoke this bug seems to need the same server-literal to be repeated twice, eg --address=/a/1.1.1.1 --address-/a/1.1.1.1 which is clearly rare in the wild, but if it did exist it could provoke a SIGSEV. Thanks to Daniel Rhea for fuzzing this one. Reference:https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=patch;h=b087cf4a6c3dd4c323a099770a44c24812381bf4 Conflict:NA --- src/domain-match.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/domain-match.c b/src/domain-match.c index e0f4313..d79967f 100644 --- a/src/domain-match.c +++ b/src/domain-match.c @@ -540,7 +540,7 @@ static int order_qsort(const void *a, const void *b) /* Finally, order by appearance in /etc/resolv.conf etc, for --strict-order */ if (rc == 0) - if (!(s1->flags & SERV_LITERAL_ADDRESS)) + if (!(s1->flags & SERV_IS_LOCAL) && !(s2->flags & SERV_IS_LOCAL)) rc = s1->serial - s2->serial; return rc; -- 2.33.0