[Security] Stack buffer overflow in ares_parse(): n++ no MAXARESULTS(16) bound, Authentication-Results with >16 results (opendmarc-ar.c:455)

[afldl]

Summary

ares_parse() (opendmarc/opendmarc-ar.c:455) parses an
Authentication-Results: header with an unbounded n++ -- there is no check
against MAXARESULTS (16). struct authres embeds ares_result[16], each
~8.5KB, declared as a stack local in mlfi_eom. A header with more than 16
;-separated results overflows the stack array (WRITE of size 4 per extra
result at :458/:476/...). Reachable remote, pre-auth: parsing happens in
mlfi_eom before the trust check.

CWE-787 / CWE-121. CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5 High.

Affected version

OpenDMARC current master (opendmarc/opendmarc-ar.c:455; MAXARESULTS=16).

Root cause

opendmarc/opendmarc-ar.c:

struct authres ar;   // stack local in mlfi_eom (opendmarc.c:2350)
...
case 3:
    ...
    n++;             // :455 -- no check against MAXARESULTS (16)

struct authres embeds struct result ares_result[MAXARESULTS] with
MAXARESULTS = 16 (opendmarc-ar.h:82); each struct result is ~8.5KB
(result_property[16][257], result_value[16][257]). The state machine
re-enters case 3 on every ; and does n++ each time; ares_convert()
returns an UNKNOWN enum for unrecognized names but does not error, so
parsing continues past 16 results.

PoC (attachment)

See attached gist: https://gist.github.com/afldl/6d1b6c4520b6f82c26649a777b42ba23

File	Purpose
harness.c	Reproducer: drives ares_parse with 17 results into ares_result[16]
stubs.c / build-config.h	Build support
repro.sh	Full ASAN build + run
asan_output.txt	Real ASAN output

Reproduction:

bash repro.sh   # or gcc -fsanitize=address harness.c stubs.c -o poc && ./poc

Expected output (real, ASAN):

calling ares_parse with 17 results (ares_result[16] array)
==445813==ERROR: AddressSanitizer: stack-buffer-overflow
WRITE of size 4
    #0 0x... in ares_parse opendmarc/opendmarc-ar.c:458:41

Suggested fix

Bound n against MAXARESULTS:

if (n >= MAXARESULTS) { /* reject / stop parsing */ }
n++;

Credit

Reported by afldl, 2026-07.

[thegushi]

Please do not report any more issues unless you have also tested them against the develop branch, you are only making more work for both of us. Can you confirm if this issue exists there?

[futatuki]

Actually in the code after 4c3fea5 in develop branch, the results after reaching max number of results are parsed but not recorded in ares_results[].

(Also, that POC uses "auth=none" but the code in develop branch only ignores them.)