c-ares / c-ares / 28589735398

90%

push

github

enforce 255 octet name limit when parsing dns names (#1164)

ares_dns_name_parse had no upper bound on the assembled name length:

- the strictly-decreasing pointer rule stops loops but not unbounded
expansion
- it accepted names past the RFC 1035 255 octet limit
- a ~64KB reply with one long name plus answer RRs that are just a
pointer back to it re-expands that name per RR (~1.2s to parse a single
packet here)
- a name built purely from compression pointers adds no label bytes, so
a length cap alone never bounds it: a ~65KB reply (an ~8k descending
pointer chain plus RRs whose name points at the top of it) still parses
in ~0.9s and returns SUCCESS, and every RR is walked with no early exit

Fixes:

- cap the running presentation length at 255 in the parse loop and
return ARES_EBADNAME past it, matching the existing check in
ares_split_dns_name on the write side
- cap compression-pointer indirections per name at 128 (a <=255 octet
name has <=128 labels), which bounds the pointer-only case the length
cap misses
- factor the 255 limit into a shared constant used by the read cap and
both write-side checks

Tests (test/ares-test-parse.cc):

- ParseRejectsOverlongName / ParseRejectsOverlongNameViaPointers
(literal labels, and length accumulated across a backward pointer)
- ParseRejectsPointerChain (pure pointer chain -> ARES_EBADNAME)
- ParseAcceptsMaxLengthName / ParseRejectsName256 (255 accepted, 256
rejected)

Duplicate #1114 is already closed; keeping this one.

---------

Signed-off-by: Syed Mohammed Nayyar <jmestwa@gmail.com>

101 of 101 new or added lines in 2 files covered. (100.0%)

23018 of 25099 relevant lines covered (91.71%)

12677.19 hits per line