Fix DNS resolver accepting an A record shorter than its RDLENGTH - #107
Merged
Merged
Conversation
response_address trusted the RDLENGTH of each answer record and unpacked a truncated RDATA into a bogus address such as "...". That string reached TCPConnectResolver#on_success, where Socket.sockaddr_in raised SocketError, and the exception escaped the event loop. Return nil when the datagram holds fewer bytes than the record declares, so a malformed response takes the existing on_failure path. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DNSResolver#response_addresstrusted the RDLENGTH of each answer record. A response whose RDATA is shorter than the declared length was unpacked into a bogus address such as"...", which reachedTCPConnectResolver#on_success, whereSocket.sockaddr_inraisedSocketError. That exception is not rescued there, so a malformed response from the nameserver stopped the event loop.This change returns
nilwhen the datagram holds fewer bytes than the record declares, so such a response takes the existingon_failurepath like any other unresolvable answer. A regression spec covers the truncated case.🤖 Generated with Claude Code