Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Fix some compression bugs in dns. #4813

Merged
merged 1 commit into from
Feb 9, 2025
Merged

Fix some compression bugs in dns. #4813

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 15 additions & 8 deletions core/net/dns.odin
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -533,18 +533,21 @@ decode_hostname :: proc(packet: []u8, start_idx: int, allocator := context.alloc
return
}

if packet[cur_idx] > 63 && packet[cur_idx] != 0xC0 {
return
}

switch packet[cur_idx] {
switch {

// This is a offset to more data in the packet, jump to it
case 0xC0:
// A pointer is when the two higher bits are set.
case packet[cur_idx] & 0xC0 == 0xC0:
if len(packet[cur_idx:]) < 2 {
return
}
pkt := packet[cur_idx:cur_idx+2]
val := (^u16be)(raw_data(pkt))^
offset := int(val & 0x3FFF)
if offset > len(packet) {
// RFC 9267 a ptr should only point backwards, enough to avoid infinity.
// "The offset at which this octet is located must be smaller than the offset
// at which the compression pointer is located". Still keep iteration_max to
// avoid tiny jumps.
if offset > len(packet) || offset >= cur_idx {
return
}

Expand All @@ -555,6 +558,10 @@ decode_hostname :: proc(packet: []u8, start_idx: int, allocator := context.alloc
level += 1
}

// Validate label len
case packet[cur_idx] > LABEL_MAX:
return

// This is a label, insert it into the hostname
case:
label_size := int(packet[cur_idx])
Expand Down