validns
validns copied to clipboard
Multiple NULL pointer dereferences
I found two occurences of NULL pointer dereferences when fuzzing validns with American Fuzzy Lop.
- The first occurence happens in the name2findable_name() function, and can be triggered with the following input:
arpa 86400 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2019021500 1800 900 604800 86400
arpa. 86400 IN RRSIG SOA 8 1 86400 20190228000000 20190214230000 49906 arpa. Qot7qHAA2QhNmAz3oJUIGmxGJrKnWsIzEvZ92R+LV03K7YTFozio2U7Z534RZBhc0UJvlF1YenrbM6ugmF0z55CJD9JY7cFicalFPOkIuWslSl62vuIWHLwN5sA7VZ0ooVN2ptQpPHDa3W/9OPJRF0YqjBBBwD7IiL7V560rbXM=
With the above input, the following call to strlen(3) in rr.c L137 results in a NULL pointer dereference because 's' ends up being NULL:
static unsigned char *name2findable_name(char *s)
{
int l = strlen(s);
- The second occurence happens in the nsec_validate_pass2() function, and can be triggered with the following input:
arpa. 86400 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2019021500 1800 900 604800 86400
arpa. 86400 IN NSEC a
With the above input, the following call to strcasecmp(3) in rr.c L788 results in a NULL pointer dereference because 'rr->next_domain' ends up being NULL:
if (strcasecmp(rr->next_domain, zone_apex) == 0) {