[musl] [PATCH] dns: fix nameserver OOB read in IPv6-disabled fallback

[musl] [PATCH] dns: fix nameserver OOB read in IPv6-disabled fallback

[Liam Wachter]

[-- Attachment #1: Type: text/plain, Size: 1059 bytes --]

  In __res_msend_rc(), the IPv6-disabled fallback check uses conf->ns[nns]
  inside a loop controlled by i, so it tests a fixed slot instead of
  walking configured nameservers. This reads one past the array's size.

  Use conf->ns[i] so the loop correctly detects whether all configured
  nameservers are IPv6-only.

  ---
   src/network/res_msend.c | 2 +-
   1 file changed, 1 insertion(+), 1 deletion(-)

  diff --git a/src/network/res_msend.c b/src/network/res_msend.c
  index fcb52513..51d42ecb 100644
  --- a/src/network/res_msend.c
  +++ b/src/network/res_msend.c
  @@ -124,7 +124,7 @@ int __res_msend_rc(int nqueries, const unsigned char
*const *queries,

        /* Handle case where system lacks IPv6 support */
        if (fd < 0 && family == AF_INET6 && errno == EAFNOSUPPORT) {
  -             for (i=0; i<nns && conf->ns[nns].family == AF_INET6; i++);
  +             for (i=0; i<nns && conf->ns[i].family == AF_INET6; i++);
                if (i==nns) {
                        pthread_setcancelstate(cs, 0);
                        return -1;

[-- Attachment #2: Type: text/html, Size: 1280 bytes --]

Re: [musl] [PATCH] dns: fix nameserver OOB read in IPv6-disabled fallback

[Szabolcs Nagy]

* Liam Wachter <liam@asymmetric.re> [2026-02-26 08:51:09 +0100]:
>   In __res_msend_rc(), the IPv6-disabled fallback check uses conf->ns[nns]
>   inside a loop controlled by i, so it tests a fixed slot instead of
>   walking configured nameservers. This reads one past the array's size.
> 
>   Use conf->ns[i] so the loop correctly detects whether all configured
>   nameservers are IPv6-only.
> 

the patch looks good.

OOB access reads value != AF_INET6 under the assumption
that the compiler does not consider separate TUs together,
so the behaviour is mostly i!=nns i.e. the check was
ineffective. i==nns only happens if uninitialized read
from conf->ns[] happens to be AF_INET6 (should be rare).

so does not look exploitable.

>   ---
>    src/network/res_msend.c | 2 +-
>    1 file changed, 1 insertion(+), 1 deletion(-)
> 
>   diff --git a/src/network/res_msend.c b/src/network/res_msend.c
>   index fcb52513..51d42ecb 100644
>   --- a/src/network/res_msend.c
>   +++ b/src/network/res_msend.c
>   @@ -124,7 +124,7 @@ int __res_msend_rc(int nqueries, const unsigned char
> *const *queries,
> 
>         /* Handle case where system lacks IPv6 support */
>         if (fd < 0 && family == AF_INET6 && errno == EAFNOSUPPORT) {
>   -             for (i=0; i<nns && conf->ns[nns].family == AF_INET6; i++);
>   +             for (i=0; i<nns && conf->ns[i].family == AF_INET6; i++);
>                 if (i==nns) {
>                         pthread_setcancelstate(cs, 0);
>                         return -1;