CARVIEW |
Select Language
HTTP/2 200
date: Tue, 15 Jul 2025 13:00:22 GMT
content-type: text/html; charset=utf-8
cache-control: max-age=0, private, must-revalidate
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
link: ; rel=preload; as=fetch; crossorigin=use-credentials
referrer-policy: no-referrer-when-downgrade
server-timing: issue_layout-fragment;desc="issue_layout fragment";dur=280.2704,issue_conversation_content-fragment;desc="issue_conversation_content fragment";dur=690.22794,issue_conversation_sidebar-fragment;desc="issue_conversation_sidebar fragment";dur=64.180305,nginx;desc="NGINX";dur=1.00696,glb;desc="GLB";dur=96.174043
strict-transport-security: max-age=31536000; includeSubdomains; preload
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Requested-With, Accept,Accept-Encoding, Accept, X-Requested-With
x-content-type-options: nosniff
x-frame-options: deny
x-voltron-version: 6a3bf42
x-xss-protection: 0
server: github.com
content-encoding: gzip
accept-ranges: bytes
set-cookie: _gh_sess=cfNiR3AjrfO1Vdew72Zdhj68P3ae7vyfQBVjTyQn4Fee0wUrPXO7ejqtaZ3FIw0LBZKKxVl23ajf3bSrCg2m6RmylaF59m8HTPp8OvJCAfF9JPhhZebz5d3inYfUeAzC6UPSgmaGx2JrA8Jtnu0RZhXZkO23ZhgwLPa7V7D9I4ezPF0e7YBisEC3nIpXlbWAWvkx5i5mCmhvxSBucTqk1IU%2BOAbQIPfPvqO%2Bru5GkjE83MThjWzMdLC%2FdxSi9yUNBlU0VGpxz5sCTCUZ%2BFzSHQ%3D%3D--%2ByVyP%2FOwajwEWv99--HuRH5YVvOO%2FexzejHGu9Bw%3D%3D; Path=/; HttpOnly; Secure; SameSite=Lax
set-cookie: _octo=GH1.1.262948991.1752584421; Path=/; Domain=github.com; Expires=Wed, 15 Jul 2026 13:00:21 GMT; Secure; SameSite=Lax
set-cookie: logged_in=no; Path=/; Domain=github.com; Expires=Wed, 15 Jul 2026 13:00:21 GMT; HttpOnly; Secure; SameSite=Lax
x-github-request-id: B72C:9BF98:91034C:A2E3C1:687650E5
Buffer overflow in the dname_to_string() function · Issue #168 · NLnetLabs/nsd · GitHub
No one assignedNo labelsNo typeNo projectsNo milestoneNone yetNo branches or pull requests
Skip to content
Navigation Menu
{{ message }}
-
-
Notifications
You must be signed in to change notification settings - Fork 112
Closed
Description
Hi,
While fuzzing nsd-checkzone in NSD 4.2.4 (and git nighly build (revision: a1879fb)), I found a buffer overflow in the dname_to_string() function, in dname.c.
Attaching a reproducer (zipped so GitHub accepts it): input_test0.zip
Issue can be reproduced by running:
nsd-checkzone all.rr input_test0
=================================================================
==2301135==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000000f7e91b at pc 0x00000043bb11 bp 0x7ffe3f9c8c20 sp 0x7ffe3f9c83b8
WRITE of size 5 at 0x000000f7e91b thread T0
#0 0x43bb10 in vsnprintf (/src/nsd-NSD_4_2_4_REL/nsd-checkzone+0x43bb10)
#1 0x43d060 in snprintf (/src/nsd-NSD_4_2_4_REL/nsd-checkzone+0x43d060)
#2 0x4e421f in dname_to_string /src/nsd-NSD_4_2_4_REL/dname.c:423:5
#3 0x61ff60 in domain_to_string /src/nsd-NSD_4_2_4_REL/./namedb.h:315:10
#4 0x61e335 in process_rr /src/nsd-NSD_4_2_4_REL/zonec.c:1435:79
#5 0x623f0f in yyparse /src/nsd-NSD_4_2_4_REL/./zparser.y:125:8
#6 0x620ce6 in zonec_read /src/nsd-NSD_4_2_4_REL/zonec.c:1627:2
#7 0x63ffff in check_zone /src/nsd-NSD_4_2_4_REL/nsd-checkzone.c:61:11
#8 0x63fc79 in main /src/nsd-NSD_4_2_4_REL/nsd-checkzone.c:131:2
#9 0x7feb592d60b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
#10 0x41da0d in _start (/src/nsd-NSD_4_2_4_REL/nsd-checkzone+0x41da0d)
0x000000f7e91b is located 0 bytes to the right of global variable 'buf' defined in 'dname.c:391:14' (0xf7e420) of size 1275
SUMMARY: AddressSanitizer: global-buffer-overflow (/src/nsd-NSD_4_2_4_REL/nsd-checkzone+0x43bb10) in vsnprintf
Shadow bytes around the buggy address:
0x0000801e7cd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0000801e7ce0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0000801e7cf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0000801e7d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0000801e7d10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0000801e7d20: 00 00 00[03]f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
0x0000801e7d30: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
0x0000801e7d40: f9 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
0x0000801e7d50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0000801e7d60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0000801e7d70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==2301135==ABORTING
Metadata
Metadata
Assignees
Labels
No labels
Type
Projects
Milestone
Relationships
Development
Issue actions
You can’t perform that action at this time.