CVE-2026-32945

PJSIP DNS Compression Pointer Heap OOB Read (Remote DoS)

Description

get_name_len() and get_name() in pjlib-util/src/pjlib-util/dns.c read a 2-byte DNS compression pointer via pj_memcpy(&offset, p, 2) without checking that both bytes lie within the packet buffer. When a 0xC0 byte (compression pointer marker) is the very last byte of a DNS response, the memcpy reads one byte past the heap allocation boundary.

A single 20-byte crafted DNS response triggers the OOB read and crashes any PJSIP application (including Asterisk and FreeSWITCH) that resolves a domain through a network-controlled DNS server.

ASan confirms: heap-buffer-overflow READ of size 2, 0 bytes after 20-byte region in get_name_len().

This is the third DNS parser CVE in pjproject's dns.c since 2022 (after CVE-2022-24793 and CVE-2023-27585). The CVE-2022-24793 fix added length checks throughout the parser but missed the compression pointer path.

Affected: pjproject <= 2.16. Fixed in pjproject 2.17 (commit 5311aee).

Usage

# Standalone ASan harness (no pjproject installation required):
./run.sh

# Or build and run manually:
gcc -fsanitize=address,undefined -g -O0 harness.c -o harness
./harness

# Network PoC -- rogue DNS server:
python3 poc.py --port 5353
# Then point a PJSIP application at the rogue server:
#   pjsua --nameserver 127.0.0.1:5353 sip:[email protected]

# Docker (builds pjproject 2.16 from source with ASan):
docker compose build
docker compose run harness

Requirements

• For standalone harness: gcc with AddressSanitizer support
• For network PoC: Python 3 (stdlib only, no external dependencies)
• For Docker: Docker + Docker Compose

Files

References

• https://github.com/pjsip/pjproject/security/advisories/GHSA-jr2p-p2w4-rr9q
• https://github.com/pjsip/pjproject/commit/5311aee398ae9d623829a6bad7b679a193c9e199

Legal Notice

This project is released under the GNU GPLv3.

It is provided for defensive security research, education, and authorized testing. Do not use this code against systems or services without explicit permission from the owner.

Unauthorized use may violate applicable law. The authors do not grant permission to test third-party systems and are not responsible for misuse.

See the LICENSE file for warranty and liability terms.