common/wireaddr: Fix an out-of-bounds bug in the address parser
What the developer wrote
Authored by Chandra Pratap
common/wireaddr: Fix an out-of-bounds bug in the address parser
Changelog-Fixed: In `struct wireaddr`, the `addr` buffer is defined
with a length of DNS_ADDRLEN (255). When parsing a valid DNS name
that is exactly 255 bytes long, the subsequent attempt to append a
`NULL` terminator overruns the buffer and triggers an out-of-bounds
error under UBSan.
Fix this by removing the line that appends `NULL`. This change is
safe because the preceding call to:
`memset(&addr->addr, 0, sizeof(addr->addr))`
already zeroes the entire buffer.
What changed, and why it matters
This commit fixes a one-byte buffer overflow in Core Lightning's network address parser. When handling a DNS address that is exactly 255 bytes long, the code tried to add a trailing zero byte past the end of a 255-byte buffer. The fix simply removes that extra write, because the buffer is already fully zeroed beforehand. It is a genuine bug fix, but the practical security impact is limited because the overflow is only one byte and occurs in a controlled parsing path.
Apply the patch. It is a clean one-line removal with no functional change for valid inputs. Consider adding a regression test with a 255-byte DNS address to prevent reintroduction.
Security signals we found
Out-of-bounds write in address parser
Buffer length off-by-one for maximum-length DNS name
UBSan-detectable undefined behavior
Fix removes unnecessary null-termination after zeroing buffer
Evidence from the diff
In common/wireaddr.c, fromwire_wireaddr() for ADDR_TYPE_DNS reads an 8-bit length, copies that many bytes into addr->addr (size DNS_ADDRLEN = 255), then wrote addr->addr[addr->addrlen] = 0. For addrlen == 255, that index is out of bounds. The commit removes the unconditional null-termination write, relying on the preceding memset(&addr->addr, 0, sizeof(addr->addr)) to keep the buffer zero-terminated. The change is minimal and correct.
Changed components
common/wireaddr.cfromwire_wireaddr()ADDR_TYPE_DNS parsing pathInspect captured patch +0 / −1
diff --git a/common/wireaddr.c b/common/wireaddr.c
index 484dd830..80b8105b 100644
--- a/common/wireaddr.c
+++ b/common/wireaddr.c
@@ -48,7 +48,6 @@ bool fromwire_wireaddr(const u8 **cursor, size_t *max, struct wireaddr *addr)
case ADDR_TYPE_DNS:
addr->addrlen = fromwire_u8(cursor, max);
memset(&addr->addr, 0, sizeof(addr->addr));
- addr->addr[addr->addrlen] = 0;
break;
default:
return false;
Why this scored 60/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.