UNDF: UNDF-2026-000001081

dnsmasq 5-MOAD scan — 2026-03-31

Source: https://thekelleys.org.uk/git/dnsmasq.git (depth=1) Focus: src/dhcp-common.c, src/cache.c, src/dhcp.c, src/option.c, src/dnsmasq.h

MOAD-0001 (CWE-407): DEFECT — dnsmasq-0001

option_filter() in src/dhcp-common.c performs two O(N²) nested loops over the dhcp_opt linked list on every outbound DHCP reply:

Untagged conflict check: inner scan for same option code with DHOPT_TAGOK
Final duplicate elimination: inner scan to suppress later duplicates

DHCP option code is 1 byte (0-255). Both passes can use a 256-element bitmap for O(N) total. Severity: MEDIUM. Patch and unit test in this directory.

Secondary candidates:

find_config_match() calls match_netid() (O(F*T) nested strcmp) inside a loop over all daemon->dhcp_conf entries: O(N * F * T) per packet. This is a real defect but harder to fix without restructuring the tag matching model.
lease_find_by_client() / lease_find_by_addr(): O(L) linear scans per packet. Not O(N²) but could benefit from a hash map keyed by client-id/addr.

MOAD-0002 (Intertangle): CLEAN (architectural note)

The daemon global struct (src/dnsmasq.h) is a god object coupling all subsystems (DNS, DHCP, TFTP, DNSSEC, filtering). This is a well-known architectural property of dnsmasq. No novel coupling introduced — the design is intentional for a small single-binary server. Marked CLEAN for our purposes.

MOAD-0003 (Leaked Context): CLEAN

dnsmasq is single-threaded (no pthread, no thread-local storage). Verified by searching for __thread, pthread_key_t, pthread_getspecific in all source files — none found. Not applicable.

MOAD-0004 (CWE-312 Logged Secret): CLEAN

Reviewed src/dnssec.c, src/crypto.c, src/forward.c, src/log.c for TSIG HMAC key material, DHCP passwords, or shared secrets in my_syslog() or log_query() calls. None found. TSIG key names are logged but not their key material values. CLEAN.

MOAD-0005 (Thundering Herd): CLEAN

dnsmasq is single-threaded. No concurrent cache access is possible. Not applicable.

2.1 KiB Raw Permalink Blame History