ab779d4e4a
Daniel Stenberg
2026-06-22
Subject
doh: stricter HTTPS RNAME parsing
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
lib/doh.c+10 -1
| @@ -1092,10 +1092,14 @@ static CURLcode doh_decode_rdata_name(const unsigned char **buf, | |
| DEBUGASSERT(buf && remaining && dnsname); | |
| if(!buf || !remaining || !dnsname || !*remaining) | |
| return CURLE_OUT_OF_MEMORY; | |
| - | curlx_dyn_init(&thename, CURL_MAXLEN_host_name); |
| + | curlx_dyn_init(&thename, CURL_MAXLEN_HOST_NAME); |
| rem = *remaining; | |
| cp = *buf; | |
| clen = *cp++; | |
| + | /* RFC 9460 says it must be uncompressed */ |
| + | if(clen > 63) |
| + | return CURLE_WEIRD_SERVER_REPLY; |
| + | |
| if(clen == 0) { | |
| /* special case - return "." as name */ | |
| if(curlx_dyn_addn(&thename, ".", 1)) | |
| @@ -1117,6 +1121,11 @@ static CURLcode doh_decode_rdata_name(const unsigned char **buf, | |
| return CURLE_OUT_OF_MEMORY; | |
| } | |
| clen = *cp++; | |
| + | if(clen > 63) { |
| + | /* invalid format */ |
| + | curlx_dyn_free(&thename); |
| + | return CURLE_WEIRD_SERVER_REPLY; |
| + | } |
| } | |
| *buf = cp; | |
| *remaining = rem - 1; | |
lib/httpsrr.h+1 -1
| @@ -31,7 +31,7 @@ | |
| #ifdef USE_HTTPSRR | |
| - | #define CURL_MAXLEN_host_name 253 |
| + | #define CURL_MAXLEN_HOST_NAME 253 |
| #define MAX_HTTPSRR_ALPNS 4 | |
| struct Curl_easy; | |
tests/unit/unit1658.c+20 -1
| @@ -493,7 +493,26 @@ static CURLcode test_unit1658(const char *arg) | |
| "ech:fe80dabbc1ff7eb38a22123456789123|" | |
| "ipv6:fe80:dabb:c1ff:fea3:8a22:1234:5678:9123|" | |
| "ipv6:ee80:dabb:c1ff:fea3:8a22:1234:5678:9125|" | |
| - | } |
| + | }, |
| + | { |
| + | "rname too long label", |
| + | (const unsigned char *)"\x00\x00" /* 16-bit prio */ |
| + | "\x40" |
| + | "0123456789012345678901234567890123456789012345678901234567890123" |
| + | "\x04some\x00", /* RNAME */ |
| + | 73, |
| + | "r:27|", |
| + | }, |
| + | { |
| + | "rname long label", |
| + | (const unsigned char *)"\x00\x00" /* 16-bit prio */ |
| + | "\x3f" |
| + | "012345678901234567890123456789012345678901234567890123456789012" |
| + | "\x04some\x00", /* RNAME */ |
| + | 72, |
| + | "r:0|p:0|" |
| + | "012345678901234567890123456789012345678901234567890123456789012.some.|", |
| + | }, |
| }; | |
| CURLcode result = CURLE_OUT_OF_MEMORY; | |