Hugo Martinez

A buffer overflow in the `extract addresses()` function allows an attacker to trigger a heap out-of-bounds read and cause a crash. This occurs when a malformed DNS response is processed, enabling the `extract name()` function to advance the pointer beyond the end of the record.

A heap buffer overflow exists in the DNS cache when processing DNS responses. The `extract name()` function can be abused because the software expands certain characters into longer escape sequences without ensuring the cache buffer is sized to hold the expanded result. Specifically, an unsafe `strcpy()` in the `really insert()` function within `src/cache.c` copies attacker-controlled name strings without bounds validation, overflowing a 1,025-byte bigname cache buffer. An attacker can exploit this by using a malicious upstream DNS server and crafted CNAME chains to corrupt memory, potentially leading to remote code execution, DNS cache poisoning to redirect lookups to attacker-controlled IP addresses, or a denial of service (DoS).