From: Olivier Houchard <ohouchard@haproxy.com>
Date: Tue, 29 Sep 2026 07:08:57 +0000 (+0200)
Subject: BUG/MEDIUM: resolvers: reject too long labels when encoding a name
X-Git-Tag: v3.5-dev10~125
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=612b87e75f399b928903141d9bf8ecf59d4f4f6b;p=haproxy.git

BUG/MEDIUM: resolvers: reject too long labels when encoding a name

A 256-byte label passed through do-resolve (e.g. from hdr(host)) wraps
its encoded length to zero. Callers using strdup() then truncate the
name but retain its full length, causing out-of-bounds reads and heap
data disclosure in DNS queries. Embedded NULs cause the same issue.

Reject labels longer than DNS_MAX_LABEL_SIZE and embedded NULs in
resolv_str_to_dn_label(), before callers duplicate the encoded name.

This affects do-resolve since its introduction in 2.0 by commit
333939c2e ("MINOR: action: new '(http-request|tcp-request content)
do-resolve' action"). Must be backported to all stable branches.
---

diff --git a/src/resolvers.c b/src/resolvers.c
index 24f9915f5..66006b663 100644
--- a/src/resolvers.c
+++ b/src/resolvers.c
@@ -1946,6 +1946,13 @@ int resolv_str_to_dn_label(const char *str, int str_len, char *dn, int dn_len)
 			offset = i+1;
 			continue;
 		}
+
+		/* labels are limited to 63 chars, and a NUL char would
+		 * truncate the name for callers relying on strdup().
+		 */
+		if (i - offset >= DNS_MAX_LABEL_SIZE || !str[i])
+			return -1;
+
 		dn[i+1] = tolower((unsigned char)str[i]);
 	}
 	dn[offset] = i - offset;