[Security] dnsParseName no destination-capacity param -> heap overflow in DNS name dump (debug builds)

[afldl]

Description

Summary

dnsParseName() (dns/dns_common.c:132) decompresses a DNS name into a caller
buffer with no destination-size parameter. The decoded name of an N-byte
message can approach N bytes, but the sink buffer is 255 bytes
(DNS_NAME_MAX_SIZE); a ~8KB mDNS/LLMNR/NBNS/spoofed-DNS message overflows
it (up to ~6.5KB past a 1536-byte pool chunk, or ~7.9KB past a 255-byte
malloc). Pre-auth reachable, but only in builds with DNS-family trace at
TRACE_LEVEL_DEBUG (the sink dnsDumpMessage is #if-excluded otherwise).

Root cause

dns/dns_common.c:132-227:

size_t dnsParseName(const DnsHeader *message, size_t length, size_t pos,
   char_t *dest, uint_t level)     // no dest capacity parameter
{
   ...
   osMemcpy(dest, src + pos, n);   // :197  copies label (up to 62B) + '.' separators
   ...
}

Caller allocates buffer = memPoolAlloc(DNS_NAME_MAX_SIZE /* 255 */)
(dns/dns_debug.c:77) then dnsParseName(message, length, pos, buffer, 0).

PoC (end-to-end)

Attachment: gist https://gist.github.com/afldl/bd146dad495206b95972926398764ad9

File	Purpose
poc.c	Reproducer: real dnsParseName logic, ~8KB name into 255-byte buffer
output.txt	Real run output

Reproduction:

gcc -fsanitize=address -o poc poc.c && ./poc

Suggested fix

Add a destination-capacity parameter to dnsParseName and bound every write
(return an error when the decoded name would exceed destSize).

Credit

Reported by afldl, 2026-07.