Hello, Thank you for maintaining HAProxy.
While fuzzing HAProxy's DNS response validator, I found a one-byte read past
the logical end of a DNS response when a TXT answer has RDLENGTH == 0.
The TXT answer parser loads the first character-string length byte before
checking that the record data contains at least one byte. A TXT answer with
RDLENGTH zero at the end of a DNS response leaves reader equal to bufend, so
reader[0] crosses the parser's logical message boundary.
A minimized 31-byte response reproduces this as a one-byte
heap-buffer-overflow in resolv_validate_dns_response() with Clang libFuzzer
and AddressSanitizer. All 13 original AFL++ crash inputs reach the same source
instruction.
The production caller currently uses a DNS_MAX_MSG_SIZE + 1 stack array while
parsing no more than DNS_MAX_MSG_SIZE bytes, and the prematurely loaded value
is discarded once the zero-length check fails. Thus I have not demonstrated a
production crash, information disclosure, out-of-bounds write, or control-flow
effect. The fix nevertheless restores the function's bufend contract and
keeps the parser safe for exactly sized callers.
Reject zero-length TXT RDATA before loading its first byte. This preserves a
valid empty TXT string, whose wire representation has RDLENGTH one followed by
a zero character-string length byte.
The affected TXT parser was introduced by commit e418e828aa ("MINOR:
resolvers: basic TXT record implementation") and is present in HAProxy 3.4.0.
This fix must be backported to 3.4; older stable branches are not affected.
Testing performed:
- reproduced the exact resolvers.c:1375:31 ASan read on revision
5129223edcd4a011c3219434cda7501ad2f52405;
- replayed and deduplicated all 13 original AFL++ findings;
- applied this patch and verified that the minimized and original inputs no
longer produce a sanitizer finding; and
- checked that the patch applies cleanly to upstream master
e4d1b143ba49b2364172395410f8b3da17caf9ae (2026-10-05).
I have attached poc.tar.gz. It is a source-only, machine-independent bundle
containing the minimized and original inputs, root-cause analysis, recorded
ASan report, proposed patch, integrity manifests, and scripts that reproduce
the vulnerable result and validate the fix with ./run.sh.
The finding was discovered with AFL++ and analyzed and packaged with automated
assistance. In accordance with HAProxy's security directions, the attachment
includes a working reproducer and a tested patch.
Please let me know if you need any additional information or would like me to
test a
proposed fix.
Regards,
maxml
poc.tar.gz
Description: GNU Zip compressed data
