Describe the bug
pktview on current master still prints a fourth byte for an A RDATA when RDLENGTH=4 but only 3 bytes are present in the packet body.
To reproduce
- Build current master
027e23a11d3a64d38406dc42313046dc2c39565e.
- Save the following hex input as
truncated_rdata.hex:
; minimal DNS response: 1 question, 1 A answer
; abnormal point: RDLENGTH says 4, but only 3 bytes follow
00 00 81 80 00 01 00 01 00 00 00 00
03 77 77 77 07 65 78 61 6d 70 6c 65
03 63 6f 6d 00 00 01 00 01
c0 0c 00 01 00 01 00 00 00 3c 00 04
01 02 03
- Run:
./pktview < truncated_rdata.hex
Expected behavior
pktview should detect the truncated RDATA and stop with an explicit parse error instead of reading bytes beyond the logical packet content.
Actual behavior
Current output on my side is:
packet length 48
id (hostorder): 0 (0x0)
flags: 0x8180
qdcount: 1
ancount: 1
nscount: 0
arcount: 0
;-- query section
rr 0 [pos 12] dname: www.example.com. len=17
type A(1) class IN(1)
;-- answer section
rr 1 [pos 33] dname: www.example.com. len=17 comprlen=2
type A(1) class IN(1) ttl 60 (0x3c) rdata len 4:
remain[4]
01 02 03 BE
System:
- Unbound version: current master, configure.ac version 1.25.1
- OS: Ubuntu 24.04.4 LTS
unbound -V output:
I built from source on current master and reproduced with ./pktview
Additional information
The issue is in testcode/pktview.c, function analyze_rdata().
Current master already contains commit 535d899be with the subject:
Fix for testcode pktview to check buffer size and log errors.
The reproducer above still succeeds because analyze_rdata() does not validate the remaining buffer length before printing remain[rdlen].
Describe the bug
pktviewon current master still prints a fourth byte for an A RDATA whenRDLENGTH=4but only 3 bytes are present in the packet body.To reproduce
027e23a11d3a64d38406dc42313046dc2c39565e.truncated_rdata.hex:./pktview < truncated_rdata.hexExpected behavior
pktviewshould detect the truncated RDATA and stop with an explicit parse error instead of reading bytes beyond the logical packet content.Actual behavior
Current output on my side is:
System:
unbound -Voutput:I built from source on current master and reproduced with
./pktviewAdditional information
The issue is in
testcode/pktview.c, functionanalyze_rdata().Current master already contains commit
535d899bewith the subject:Fix for testcode pktview to check buffer size and log errors.The reproducer above still succeeds because
analyze_rdata()does not validate the remaining buffer length before printingremain[rdlen].