Contiki-NG CVE-2026-5856

Contiki-NG is an open-source RTOS for constrained IoT devices that includes a lightweight DNS/mDNS resolver in os/services/resolv/resolv.c. DNS wire-format names consist of length-prefixed label sequences optionally terminated by compression pointers - two-byte references into the packet body. The vulnerable skip_name() function traversed these labels using only a raw pointer increment with no awareness of the enclosing packet boundary, meaning it could walk arbitrarily far into memory adjacent to the UDP receive buffer uip_buf. CWE-125 (Out-of-Bounds Read) describes this root cause precisely. The compounding flaw in newdata() is that the nquestions loop counter was cast from the DNS header's 16-bit field to a uint8_t without any validation and consumed before the transaction ID check, handing the attacker direct control over loop iteration count. The commit diff confirms that the fix adds packet and packet_len parameters to skip_name(), decode_name(), and dns_name_isequal(), introduces explicit query >= end boundary guards at every pointer advance, validates the DNS header minimum length before reading any fields, and changes callers to treat a NULL return from skip_name() as a fatal parse error.