Fishwaldo opened a new pull request, #19730:
URL: https://github.com/apache/nuttx/pull/19730
## Summary
* A DNS answer that sits at the end of a response is rejected as truncated,
so an A record lookup succeeds or fails depending on how much padding the
server happened to send after it.
* `dns_recv_response()` in `libs/libc/netdb/lib_dnsquery.c` checks that
enough of the response remains to hold an answer header. It sized that
check with `sizeof(struct dns_answer_s)`, but that structure is the
10-byte header plus a union holding the largest address it can carry.
With IPv6 built the union is 16 bytes, so the check demanded 26 bytes
where 10 were needed.
* The header size is now a named constant, `DNS_ANSWER_HEADER_SIZE`, beside
the structure in `include/nuttx/net/dns.h`. The rest of this function
already used the literal 10 for the same quantity.
* Only IPv4-only builds escaped it: there `sizeof` happens to equal 14, and
an A record supplies exactly 14 bytes.
* No related issue filed.
## Impact
* Is new feature added? Is existing feature changed? **NO.** Bug fix only.
* Impact on user? **YES, positive.** Lookups that previously returned only
the AAAA record, or nothing, now return the A record too. No API change,
no configuration change.
* Impact on build? **NO.**
* Impact on hardware? **NO.** Architecture-independent libc code.
* Impact on documentation? **NO.**
* Impact on security? **Worth a note.** The check is a bounds check and
this
lowers the threshold from 26 bytes to 10. That is the correct bound: 10
is
`sizeof` the header fields actually dereferenced at that point
(`type`, `class`, `ttl`, `len`), and the variable-length address that
follows is bounds checked separately, further down, against its own `len`
field. No read is widened.
* Impact on compatibility? **NO.** IPv4-only builds see no behavioural
change.
* Anything else? The old bound was not merely conservative, it was
inconsistent: the surrounding code already advances by the literal 10.
## Testing
I confirm that changes are verified on local setup and works as intended:
* Build Host: macOS 26.5.1, arm64 (Apple Silicon), xPack riscv-none-elf-gcc
15.2.0
* Target: RISC-V, ESWIN EIC7700X EVB (downstream board port, not yet
upstream), kernel build, IPv4+IPv6 enabled
Reproduce by querying a server that returns a bare answer with no authority
or additional records, so the answer is last in the packet:
```
$ dig +noedns @10.1.1.2 github.com A # ANSWER 1, AUTHORITY 0,
ADDITIONAL 0
-> answer is last in the packet, 14 bytes remain, rejected
$ dig +noedns @10.11.5.254 github.com A # ANSWER 1, AUTHORITY 13,
ADDITIONAL 7
-> 26+ bytes remain, accepted
```
Testing logs before change:
```
nsh> nslookup apache.org
[CPU1] dns_recv_response: DNS answer header truncated
Host: apache.org Addr: 2a04:4e42::644
```
The AAAA record arrives; the A record is discarded.
Testing logs after change:
```
nsh> nslookup apache.org
Host: apache.org Addr: 2a04:4e42::644
Host: apache.org Addr: 151.101.2.132
```
## PR verification Self-Check
* [x] This PR introduces only one functional change.
* [x] I have updated all required description fields above.
* [x] My PR adheres to Contributing Guidelines and Documentation.
* [ ] My PR is still work in progress (not ready for review).
* [x] My PR is ready for review and can be safely merged into a codebase.
---
*Claude (claude-opus-5) assisted with diagnosing this bug and with authoring
the
code comment and this PR description. The commit carries an `Assisted-by:`
tag
per
[CONTRIBUTING.md](https://github.com/apache/nuttx/blob/master/CONTRIBUTING.md)
ยง1.5.*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
