# [tor] libevent dns OOB read

Libevent DNS search_make_new reads one byte before a zero-length hostname buffer, causing an ASAN heap-buffer-overflow crash.

- Payout: hidden
- Severity: low
- Program: Tor
- Found by: guido
- Disclosed: 2017-10-19
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/115702
- Library page: https://bugbountylibrary.com/r/h1%3A115702
- Tags: area:devices domain:network impact:dos kind:bounty platform:hackerone sev:low tech:linux technique:source-review vuln:dos vuln:memory-corruption

**Target:** libevent DNS resolver (search_make_new)
**Root cause:** search_make_new computes base_name[base_len - 1] without checking base_len, so a zero-length base_name indexes -1 and reads one byte before the buffer.
**Steps:**
1. Build libevent with ASAN: `CFLAGS='-fomit-frame-pointer -fsanitize=address' ./configure && make -j4`
2. Place attached resolv.conf and poc.c in source dir
3. Compile: `gcc -fsanitize=address -fomit-frame-pointer poc.c .libs/libevent.a`
4. Run `./a.out`; poc.c allocates `char* hostname = malloc(32); memset(hostname, 0, 32);` producing a zero-length string
5. ASAN reports heap-buffer-overflow READ of size 1 in search_make_new
**How found:** Code reading of libevent DNS search code spotted the unchecked `base_name[base_len - 1]` index; confirmed by crafting a zero-length hostname in a PoC.
**Insight:** DNS search-list code that appends a trailing dot often assumes a non-empty name; fuzz resolver configs and hostname inputs with empty strings to hit off-by-one reads at buffer[-1].