c-ares / c-ares / 28590907030

90%

Build Type

push

github

Committed by web-flow

Commit Message

discard oversized UDP datagrams instead of truncating the length frame (#1161)

Defense-in-depth hardening for the UDP receive path.

read_conn_packets() prefixes each buffered UDP datagram with a 2-byte
length so read_answers() can later split the buffer back into messages.
The read buffer handed to recvfrom() comes from ares_buf_append_start(),
which grows in powers of two and so can be larger than 65535 bytes,
while count is written back through (unsigned short). If a datagram
larger than 65535 ever landed there, count & 0xFFFF would be stored and
the framing of everything buffered after it would desync.

This isn't reachable over standard UDP: max payload is 65507 (IPv4) /
65527 (IPv6), both below 65535. The only vector is IPv6 jumbograms (RFC
2675), which DNS never uses and which would still have to pass the
source-address check in ares_conn_read(). So this is purely hardening,
not a fix for an observed bug on real networks.

The guard rolls the datagram back to the iteration start and stops
reading, matching the existing short-read rollback just above. Only
ares_buf_* is used.

---------

Signed-off-by: Syed Mohammed Nayyar <jmestwa@gmail.com>

Coverage Stats

1 of 3 new or added lines in 1 file covered. (33.33%)

1 existing line in 1 file now uncovered.

23020 of 25101 relevant lines covered (91.71%)

12574.42 hits per line