[Dnsmasq-discuss] [PATCH] Don't hand a NULL hostname to my_syslog() in slaac_ping_reply().

[Simon Kelley]

This is definitely a real problem, but the fix goes a bit deeper, 
because the AAAA DNS record has to be changed when the name moves as well.

I think that

https://thekelleys.org.uk/gitweb-noai/?p=dnsmasq.git;a=commit;h=03fd0c19efbc68710bf96784adcbb402deef9726

Addresses all the issues.


Cheers,

Simon.


On 01/10/2026 00:00, Martin Vlach wrote:
> slaac_add_addrs() won't create SLAAC addresses for a lease without a
> hostname, but addresses already attached to a lease stay around if the
> hostname goes away later, e.g. via kill_name() when another client
> claims the same name. A matching ICMPv6 echo reply then makes
> slaac_ping_reply() pass lease->hostname == NULL to a %s format, which is
> undefined behaviour (glibc and musl just print "(null)").
> 
> Log "*" in that case, like the lease file code in lease.c already does.
> 
> Co-Authored-By: Claude Sonnet 5.5 <noreply at anthropic.com>
> ---
> Another one from the same BudgetScan run. On glibc/musl it's purely
> cosmetic ("(null)" in the log), so take it or leave it.
> 
> It can happen without DHCPv6: a second DHCPv4 client claiming the same
> (client supplied) name makes lease_set_hostname() call kill_name() on the
> first lease while that one still has an unconfirmed SLAAC address
> (backoff != 0), and the echo reply then hits the log line. Found by
> reading the code, I haven't reproduced it at runtime. Builds fine (macOS
> only).
> 
>   src/slaac.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/src/slaac.c b/src/slaac.c
> index ca92ac0..f696fdb 100644
> --- a/src/slaac.c
> +++ b/src/slaac.c
> @@ -204,7 +204,7 @@ void slaac_ping_reply(struct in6_addr *sender, unsigned char *packet, char *inte
>   	    gotone = 1;
>   	    inet_ntop(AF_INET6, sender, daemon->addrbuff, ADDRSTRLEN);
>   	    if (!option_bool(OPT_QUIET_DHCP6))
> -	      my_syslog(MS_DHCP | LOG_INFO, "SLAAC-CONFIRM(%s) %s %s", interface, daemon->addrbuff, lease->hostname);
> +	      my_syslog(MS_DHCP | LOG_INFO, "SLAAC-CONFIRM(%s) %s %s", interface, daemon->addrbuff, lease->hostname ? lease->hostname : "*");
>   	  }
>     
>     lease_update_dns(gotone);
> 
> _______________________________________________
> Dnsmasq-discuss mailing list
> Dnsmasq-discuss at lists.thekelleys.org.uk
> https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss
>