[2019-07-18] - Found with American Fuzzy Lop - CVE-2019-13951 Stack-based buffer overflow in the set_ipv4() function, in zscan_rfc1035.rl. It can be triggered with the following input: ``` ns1.all.rr.org. IN A 10.1.0.529999999999999999999999999999999 ``` The issue can be be reproduced by creating a 'zones' directory, putting the above input in a file within the 'zones' directory, and running: ``` gdnsd -c . checkconf ``` Because no bounds checking is being done in the set_ipv4() function, 'len' ends up being larger than 16: ``` static void set_ipv4(zscan_t* z, const char* end) { char txt[16]; unsigned len = end - z->tstart; memcpy(txt, z->tstart, len); ``` The parser is attempting to parse malformed IPv4 addresses until there is no input left. I have been able to get 'len' to reach very large values when generating malformed IPv4 address strings spawning several gigabytes, which gdnsd will happily attempt to parse.