common: fix bad formatting for DNS-type wireaddr.
What the developer wrote
Authored by Rusty Russell
common: fix bad formatting for DNS-type wireaddr.
Found by @Chand-ra fuzzing test!
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
What changed, and why it matters
This commit fixes a formatting bug in Core Lightning where DNS-type network addresses were printed as plain text strings without using their known length. The old code passed a pointer to DNS address bytes directly to a string formatter, which could read past the intended data if the bytes were not null-terminated, potentially leaking nearby memory or crashing the program. The fix prints only the exact number of bytes that make up the DNS address.
Apply the patch. Review other address type formatters for similar length-handling issues. Consider adding regression tests with DNS addresses containing embedded null bytes or non-null-terminated inputs.
Security signals we found
Out-of-bounds read due to treating length-prefixed data as null-terminated string
Potential memory disclosure or crash in address formatting
Discovered via fuzzing, indicating input-driven memory-safety issue
Single-character fix in format specifier suggests localized but real bug
Evidence from the diff
In common/wireaddr.c, fmt_wireaddr_without_port() handles ADDR_TYPE_DNS by formatting the address. Previously it used tal_fmt(ctx, “%s”, a->addr), treating a->addr as a null-terminated C string even though it is a length-prefixed binary field of size a->addrlen. The fix changes the format to “%.*s” with a->addrlen and a->addr so only the intended bytes are read. This removes an out-of-bounds read risk and prevents possible information disclosure or denial-of-service from unterminated data. The bug was found through fuzzing by @Chand-ra.
Changed components
common/wireaddr.cfmt_wireaddr_without_port()DNS address formattingInspect captured patch +1 / −1
diff --git a/common/wireaddr.c b/common/wireaddr.c
index 80b8105b..b110ed54 100644
--- a/common/wireaddr.c
+++ b/common/wireaddr.c
@@ -262,7 +262,7 @@ char *fmt_wireaddr_without_port(const tal_t * ctx, const struct wireaddr *a)
return tal_fmt(ctx, "%s.onion",
b32_encode(tmpctx, a->addr, a->addrlen));
case ADDR_TYPE_DNS:
- return tal_fmt(ctx, "%s", a->addr);
+ return tal_fmt(ctx, "%.*s", a->addrlen, a->addr);
}
hex = tal_hexstr(ctx, a->addr, a->addrlen);
Why this scored 35/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.