-
Notifications
You must be signed in to change notification settings - Fork 30.7k
New issue
Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? # to your account
dns.resolveSoa returns EBADRESP if hostname has a CNAME record #34612
Comments
Thanks for the bug report. At first glance this appears to be a bug in our response parsing logic. Lines 1078 to 1080 in 74df749
@addaleax @XadillaX Maybe not the root cause but those bounds checks look like UB to me. Pointers in C and C++ are allowed to point one element past the end of an array and no more. The check should look like this: diff --git a/src/cares_wrap.cc b/src/cares_wrap.cc
index 73a0ac6b33..778e0821d7 100644
--- a/src/cares_wrap.cc
+++ b/src/cares_wrap.cc
@@ -1075,7 +1075,7 @@ int ParseSoaReply(Environment* env,
return status == ARES_EBADNAME ? ARES_EBADRESP : status;
}
- if (ptr + temp_len + NS_QFIXEDSZ > buf + len) {
+ if (temp_len > LONG_MAX - NS_QFIXEDSZ || temp_len + NS_QFIXEDSZ > len) {
return ARES_EBADRESP;
}
ptr += temp_len + NS_QFIXEDSZ; |
@bnoordhuis I'd like to work on this. |
@bnoordhuis - This At this point, I think the problem exists in the Also while working on this, I discovered a bug related to free call on garbage pointer. #35502 |
v20.11.0 the bug is still there |
This issue (if so) comes indeed from this condition in |
What steps will reproduce the bug?
Actual Results
hostname: support.microsoft.com
CNAME result: [ 'ev.support.microsoft.com.edgekey.net' ]
SOA result: querySoa EBADRESP support.microsoft.com
Expected Results
hostname: support.microsoft.com
CNAME result: [ 'ev.support.microsoft.com.edgekey.net' ]
SOA result: querySoa ENODATA support.microsoft.com
Additional information
This seems to happen for any hostname with a CNAME record.
Another example:
hostname: store.gocomics.com
CNAME result: [ 'gocomicsstore.wpengine.com' ]
SOA result: querySoa EBADRESP store.gocomics.com
I would expect to get an 'ENODATA' instead of 'EBADRESP', as with the other resolveXXX() calls.
For a hostname with an SOA record but no CNAME, you get:
hostname: microsoft.com
CNAME result: queryCname ENODATA microsoft.com
SOA result: {"nsname":"ns1-205.azure-dns.com","hostmaster":"azuredns-
hostmaster.microsoft.com","serial":1,"refresh":3600,"retry":300,"expire":2419200,"minttl":300}
The text was updated successfully, but these errors were encountered: