Skip to content

pktview still reads past logical RDATA length on truncated A RR input on current master #1447

Description

@Egoist-debug

Describe the bug
pktview on current master still prints a fourth byte for an A RDATA when RDLENGTH=4 but only 3 bytes are present in the packet body.

To reproduce

  1. Build current master 027e23a11d3a64d38406dc42313046dc2c39565e.
  2. Save the following hex input as truncated_rdata.hex:
    ; minimal DNS response: 1 question, 1 A answer
    ; abnormal point: RDLENGTH says 4, but only 3 bytes follow
    00 00 81 80 00 01 00 01 00 00 00 00
    03 77 77 77 07 65 78 61 6d 70 6c 65
    03 63 6f 6d 00 00 01 00 01
    c0 0c 00 01 00 01 00 00 00 3c 00 04
    01 02 03
    
  3. Run:
    ./pktview < truncated_rdata.hex

Expected behavior
pktview should detect the truncated RDATA and stop with an explicit parse error instead of reading bytes beyond the logical packet content.

Actual behavior
Current output on my side is:

packet length 48
id (hostorder): 0 (0x0)
flags: 0x8180
qdcount: 1
ancount: 1
nscount: 0
arcount: 0
;-- query section
rr 0 [pos 12] dname: www.example.com. len=17
type A(1) class IN(1)
;-- answer section
rr 1 [pos 33] dname: www.example.com. len=17 comprlen=2
type A(1) class IN(1)  ttl 60 (0x3c) rdata len 4:
 remain[4]
 01 02 03 BE

System:

  • Unbound version: current master, configure.ac version 1.25.1
  • OS: Ubuntu 24.04.4 LTS
  • unbound -V output:
    I built from source on current master and reproduced with ./pktview

Additional information
The issue is in testcode/pktview.c, function analyze_rdata().

Current master already contains commit 535d899be with the subject:
Fix for testcode pktview to check buffer size and log errors.

The reproducer above still succeeds because analyze_rdata() does not validate the remaining buffer length before printing remain[rdlen].

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions