Re: [PATCH] rdata: fix out-of-bounds write in NID and L64 tostruct()
Ondřej Surý <[email protected]> Thu, 2 Jul 2026 11:09:12 +0200
| Newsgroups | gmane.network.dns.bind.user |
|---|---|
| Message-ID | <[email protected]> |
SGkgSXNtYWlsLAoKeW91IHNlZW0gdG8ga2VlcCBkdW1waW5nIGlzc3VlcyB0aGF0IG1pZ2h0IGJl IHBvdGVudGlhbCBzZWN1cml0eSBpc3N1ZXMKb24gdGhlIHB1YmxpYyBtYWlsaW5nIGxpc3QsIHNv IEkgYW0gcHV0dGluZyB5b3VyIGFjY291bnQgb24gYSBtb2RlcmF0aW9uLgoKT24gdG9wIG9mIHRo YXQsIHlvdSBkb24ndCBzZWVtIHRvIGV2ZW4gYm90aGVyIHRvIGxvb2sgYXQgdGhlIGV4aXN0aW5n IGlzc3VlcwphbmQganVzdCBkdW1waW5nIExMTSBmb3VuZCBpc3N1ZXMgb24gdXMuCgpUaGlzIGlz IGFscmVhZHkgYmVpbmcgdHJhY2tlZCBhcyBodHRwczovL2dpdGxhYi5pc2Mub3JnL2lzYy1wcm9q ZWN0cy9iaW5kOS8tL3dvcmtfaXRlbXMvNjA5NwphbmQgaXQgaXMgbm90IGEgc2VjdXJpdHkgaXNz dWUuCgpPbmRyZWoKLS0KT25kxZllaiBTdXLDvSAoSGUvSGltKQpvbmRyZWpAaXNjLm9yZwoKQURI RCBicmFpbiBhdCB3b3JrOiBJIHNvbWV0aW1lcyBsb3NlIHRyYWNrIG9mIG15IGluYm94LiBQbGVh c2UgZmVlbCBmcmVlIHRvIHNlbmQgYSBnZW50bGUgbnVkZ2UgaWYgeW91J3JlIHdhaXRpbmcgb24g YSByZXBseSEKCk15IHdvcmtpbmcgaG91cnMgYW5kIHlvdXIgd29ya2luZyBob3VycyBtYXkgYmUg ZGlmZmVyZW50LiBQbGVhc2UgZG8gbm90IGZlZWwgb2JsaWdhdGVkIHRvIHJlcGx5IG91dHNpZGUg eW91ciBub3JtYWwgd29ya2luZyBob3Vycy4KCj4gT24gMi4gNy4gMjAyNiwgYXQgMTA6NTEsIElz bWFpbCBSYW16aSA8aXNtYWlsQGJ1Z3FvcmUuY29tPiB3cm90ZToKPiAKPiB0b3N0cnVjdF9uaWQo KSBhbmQgdG9zdHJ1Y3RfbDY0KCkgcmVhZCB0aGUgMTYtYml0IFByZWZlcmVuY2UgZmllbGQgd2l0 aAo+IHVpbnQxNl9mcm9tcmVnaW9uKCksIHdoaWNoIG9ubHkgcmVhZHMgcmVnaW9uLT5iYXNlWzAu LjFdIGFuZCBkb2VzIG5vdAo+IGFkdmFuY2UgdGhlIHJlZ2lvbi4gVW5saWtlIHRoZSBzaWJsaW5n IHRvc3RydWN0X2xwKCksIHRoZXkgYXJlIG1pc3NpbmcKPiB0aGUgZm9sbG93aW5nIGlzY19yZWdp b25fY29uc3VtZSgmcmVnaW9uLCAyKSwgc28gYXQgdGhlIG1lbW1vdmUoKSB0aGUKPiByZWdpb24g c3RpbGwgaGFzIGxlbmd0aCAxMCBhbmQgc3RpbGwgcG9pbnRzIGF0IHRoZSBzdGFydCBvZiB0aGUg cmRhdGE6Cj4gCj4gZG5zX3JkYXRhX3RvcmVnaW9uKHJkYXRhLCAmcmVnaW9uKTsgICAgICAgIC8q IHJlZ2lvbi5sZW5ndGggPT0gMTAgKi8KPiBuaWQtPnByZWYgPSB1aW50MTZfZnJvbXJlZ2lvbigm cmVnaW9uKTsgICAgLyogZG9lcyBub3QgY29uc3VtZSAqLwo+IG1lbW1vdmUobmlkLT5uaWQsIHJl Z2lvbi5iYXNlLCByZWdpb24ubGVuZ3RoKTsKPiAKPiBkbnNfcmRhdGFfbmlkX3QubmlkIGFuZCBk bnNfcmRhdGFfbDY0X3QubDY0IGFyZSBmaXhlZCA4LWJ5dGUgdHJhaWxpbmcKPiBhcnJheXMsIGFu ZCBmcm9td2lyZS9mcm9tdGV4dCBwaW4gcmRhdGEtPmxlbmd0aCB0byBleGFjdGx5IDEwIGZvciB0 aGVzZQo+IHR5cGVzLiBUaGUgbWVtbW92ZSB0aGVyZWZvcmUgY29waWVzIDEwIGJ5dGVzIGludG8g YW4gOC1ieXRlIGFycmF5LCBhCj4gMi1ieXRlIG91dC1vZi1ib3VuZHMgd3JpdGUgcGFzdCB0aGUg Y2FsbGVyLXN1cHBsaWVkIHN0cnVjdHVyZSwgYW5kIGFsc28KPiBzdG9yZXMgdGhlIHdyb25nIGJ5 dGVzICh0aGUgdHdvIFByZWZlcmVuY2Ugb2N0ZXRzIGxhbmQgaW4gbmlkWzAuLjFdCj4gaW5zdGVh ZCBvZiB0aGUgTm9kZSBJRCkuCj4gCj4gVGhpcyBpcyByZWFjaGFibGUgZnJvbSBkbnNfcmRhdGFf dG9zdHJ1Y3QoKSBvbiBhbnkgdmFsaWQgTklEIChSRkMgNjc0MiwKPiB0eXBlIDEwNCkgb3IgTDY0 ICh0eXBlIDEwNikgcmVjb3JkIHBhcnNlZCBmcm9tIHRoZSBuZXR3b3JrIG9yIGEgem9uZQo+IGZp bGUuCj4gCj4gQWRkIHRoZSBtaXNzaW5nIGlzY19yZWdpb25fY29uc3VtZSgmcmVnaW9uLCAyKSBz byB0aGF0IGV4YWN0bHkgdGhlCj4gOC1ieXRlIGxvY2F0b3IgaXMgY29waWVkLCBtYXRjaGluZyB0 b3N0cnVjdF9scCgpLgo+IAo+IFNpZ25lZC1vZmYtYnk6IElzbWFpbCBSYW16aSA8aXNtYWlsQGJ1 Z3FvcmUuY29tPgo+IC0tLQo+IGRpZmYgLS1naXQgYS9saWIvZG5zL3JkYXRhL2dlbmVyaWMvbDY0 XzEwNi5jIGIvbGliL2Rucy9yZGF0YS9nZW5lcmljL2w2NF8xMDYuYwo+IGluZGV4IDVlOWI0MmUu LmZiMDBlYTEgMTAwNjQ0Cj4gLS0tIGEvbGliL2Rucy9yZGF0YS9nZW5lcmljL2w2NF8xMDYuYwo+ ICsrKyBiL2xpYi9kbnMvcmRhdGEvZ2VuZXJpYy9sNjRfMTA2LmMKPiBAQCAtMTUxLDYgKzE1MSw3 IEBAIHRvc3RydWN0X2w2NChBUkdTX1RPU1RSVUNUKSB7Cj4gCj4gZG5zX3JkYXRhX3RvcmVnaW9u KHJkYXRhLCAmcmVnaW9uKTsKPiBsNjQtPnByZWYgPSB1aW50MTZfZnJvbXJlZ2lvbigmcmVnaW9u KTsKPiArIGlzY19yZWdpb25fY29uc3VtZSgmcmVnaW9uLCAyKTsKPiBtZW1tb3ZlKGw2NC0+bDY0 LCByZWdpb24uYmFzZSwgcmVnaW9uLmxlbmd0aCk7Cj4gcmV0dXJuIElTQ19SX1NVQ0NFU1M7Cj4g fQo+IGRpZmYgLS1naXQgYS9saWIvZG5zL3JkYXRhL2dlbmVyaWMvbmlkXzEwNC5jIGIvbGliL2Ru cy9yZGF0YS9nZW5lcmljL25pZF8xMDQuYwo+IGluZGV4IDgwZDA1MzMuLmNlNTNhOGYgMTAwNjQ0 Cj4gLS0tIGEvbGliL2Rucy9yZGF0YS9nZW5lcmljL25pZF8xMDQuYwo+ICsrKyBiL2xpYi9kbnMv cmRhdGEvZ2VuZXJpYy9uaWRfMTA0LmMKPiBAQCAtMTUxLDYgKzE1MSw3IEBAIHRvc3RydWN0X25p ZChBUkdTX1RPU1RSVUNUKSB7Cj4gCj4gZG5zX3JkYXRhX3RvcmVnaW9uKHJkYXRhLCAmcmVnaW9u KTsKPiBuaWQtPnByZWYgPSB1aW50MTZfZnJvbXJlZ2lvbigmcmVnaW9uKTsKPiArIGlzY19yZWdp b25fY29uc3VtZSgmcmVnaW9uLCAyKTsKPiBtZW1tb3ZlKG5pZC0+bmlkLCByZWdpb24uYmFzZSwg cmVnaW9uLmxlbmd0aCk7Cj4gcmV0dXJuIElTQ19SX1NVQ0NFU1M7Cj4gfQo+IC0tIAo+IFZpc2l0 IGh0dHBzOi8vbGlzdHMuaXNjLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2JpbmQtdXNlcnMgdG8gdW5z dWJzY3JpYmUgZnJvbSB0aGlzIGxpc3QuCgotLSAKVmlzaXQgaHR0cHM6Ly9saXN0cy5pc2Mub3Jn L21haWxtYW4vbGlzdGluZm8vYmluZC11c2VycyB0byB1bnN1YnNjcmliZSBmcm9tIHRoaXMgbGlz dC4K