dnslib icon indicating copy to clipboard operation
dnslib copied to clipboard

error when decoding compressed domain name

Open jiangzhuti opened this issue 6 years ago • 3 comments

RFC 1035 4.1.4 says:

The compression scheme allows a domain name in a message to be represented as either:

  • a sequence of labels ending in a zero octet
  • a pointer
  • a sequence of labels ending with a pointer

so when decoding a dns packet which contains a pointer-ending CNAME at the end, the code runs here: https://github.com/mnezerka/dnslib/blob/master/src/buffer.cpp#L287 saveBuffPos is equal to the buffer's size, then, at line 290 setPos(saveBuffPos);, an exception is thrown.

jiangzhuti avatar Jul 09 '19 08:07 jiangzhuti

Hi @jiangzhuti, thank you for all your findings. If you already have a fix, don't hesitate to come with PR. I'll appreciate it since I'm no longer working in area of telecommunication test automation and it will definitely take some time to refresh my knowledge of those RFCs and fix it properly.

mnezerka avatar Jul 09 '19 10:07 mnezerka

Hi @jiangzhuti, thank you for all your findings. If you already have a fix, don't hesitate to come with PR. I'll appreciate it since I'm no longer working in area of telecommunication test automation and it will definitely take some time to refresh my knowledge of those RFCs and fix it properly.

ok, I will try. This is an interesting project.

jiangzhuti avatar Jul 09 '19 13:07 jiangzhuti

To be able to validate your PRs and decision to change setPos(), would it be possible to share an example of call which is causing problems? I mean - fragment of code (or unit test) that fails for your "pointer-ending CNAME" packet? I could spend some time to thing about this case and see the execution flow. Allowing of buffer to point at byte which doesn't belong to it is something I'm trying to avoid. May be, there is a different approach to solve this issue - e.g. check if buffer is full or something similar.

mnezerka avatar Feb 27 '23 11:02 mnezerka