This is an automated email from the ASF dual-hosted git repository.
acassis pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git
The following commit(s) were added to refs/heads/master by this push:
new cda33ae4fcb libs/libc/netdb: Size an answer header by its header, not
by its union.
cda33ae4fcb is described below
commit cda33ae4fcb98cd61d42fd50c4a704ada3a0e753
Author: Justin Hammond <[email protected]>
AuthorDate: Tue Aug 4 13:05:26 2026 +0800
libs/libc/netdb: Size an answer header by its header, not by its union.
dns_recv_response() checked for room using sizeof(struct dns_answer_s),
but that structure is the 10-byte header plus a union holding the largest
address it can carry. With IPv6 built the union is 16 bytes, so the check
demanded 26 bytes where 10 were needed, and any answer sitting at the end
of a response was rejected as truncated.
An A record answer supplies 14 bytes, so whether a lookup worked depended
on how much padding the server happened to send after it:
$ dig +noedns @10.1.1.2 github.com A # ANSWER 1, AUTHORITY 0,
ADDITIONAL 0
-> answer is last in the packet, 14 bytes remain, rejected
$ dig +noedns @10.11.5.254 github.com A # ANSWER 1, AUTHORITY 13,
ADDITIONAL 7
-> 26+ bytes remain, accepted
On the board, before and after, against the first of those servers:
nsh> nslookup apache.org
[CPU1] dns_recv_response: DNS answer header truncated
Host: apache.org Addr: 2a04:4e42::644 <- A record lost
nsh> nslookup apache.org
Host: apache.org Addr: 2a04:4e42::644
Host: apache.org Addr: 151.101.2.132 <- both returned
The address that follows the header is already bounds checked separately,
where its real length is known, so only the header check was wrong. The
size is now a named constant next to the structure, since the rest of this
function already used the literal 10 for the same quantity.
Only IPv4-only builds escaped it, where sizeof happens to equal 14 and an
A record fits exactly.
Assisted-by: Claude:claude-opus-5
Signed-off-by: Justin Hammond <[email protected]>
---
include/nuttx/net/dns.h | 13 +++++++++++++
libs/libc/netdb/lib_dnsquery.c | 20 ++++++++++----------
2 files changed, 23 insertions(+), 10 deletions(-)
diff --git a/include/nuttx/net/dns.h b/include/nuttx/net/dns.h
index d1a1e2c301d..8eb5b6c78aa 100644
--- a/include/nuttx/net/dns.h
+++ b/include/nuttx/net/dns.h
@@ -158,6 +158,19 @@ begin_packed_struct struct dns_question_s
/* The DNS answer message structure */
+/* The fixed part of an answer: type, class, ttl and length, before the
+ * address itself.
+ *
+ * Use this rather than sizeof(struct dns_answer_s) to test whether a
+ * response holds a whole answer header. That structure also carries the
+ * union below, sixteen bytes once IPv6 is built, so its sizeof demands far
+ * more of the response than the header needs and wrongly rejects a
+ * trailing answer as truncated. The address that follows is bounds
+ * checked separately, against its len field.
+ */
+
+#define DNS_ANSWER_HEADER_SIZE 10
+
begin_packed_struct struct dns_answer_s
{
uint16_t type;
diff --git a/libs/libc/netdb/lib_dnsquery.c b/libs/libc/netdb/lib_dnsquery.c
index d3231a9adf6..adf14ba8f02 100644
--- a/libs/libc/netdb/lib_dnsquery.c
+++ b/libs/libc/netdb/lib_dnsquery.c
@@ -694,13 +694,13 @@ static int dns_recv_response(int sd, FAR union dns_addr_u
*addr, int naddr,
break;
}
- /* Verify that a complete answer header (10 bytes: type, class,
- * ttl[2], len) is available before casting to dns_answer_s.
- * Without this check, accessing ans->ttl and ans->type/class/len
- * would be an OOB read if fewer than 10 bytes remain.
+ /* Verify that a complete answer header is available before casting
+ * to dns_answer_s. Without this check, accessing ans->ttl and
+ * ans->type/class/len would be an OOB read if fewer than
+ * DNS_ANSWER_HEADER_SIZE bytes remain.
*/
- if (nameptr + sizeof(struct dns_answer_s) > endofbuffer)
+ if (nameptr + DNS_ANSWER_HEADER_SIZE > endofbuffer)
{
ret = -EILSEQ;
nwarn("DNS answer header truncated\n");
@@ -726,11 +726,11 @@ static int dns_recv_response(int sd, FAR union dns_addr_u
*addr, int naddr,
if (ans->type == HTONS(DNS_RECTYPE_A) &&
ans->class == HTONS(DNS_CLASS_IN) &&
ans->len == HTONS(4) &&
- nameptr + 10 + 4 <= endofbuffer)
+ nameptr + DNS_ANSWER_HEADER_SIZE + 4 <= endofbuffer)
{
FAR struct sockaddr_in *inaddr;
- nameptr += 10 + 4;
+ nameptr += DNS_ANSWER_HEADER_SIZE + 4;
ninfo("IPv4 address: %u.%u.%u.%u\n",
ip4_addr1(ans->u.ipv4.s_addr),
@@ -755,11 +755,11 @@ static int dns_recv_response(int sd, FAR union dns_addr_u
*addr, int naddr,
if (ans->type == HTONS(DNS_RECTYPE_AAAA) &&
ans->class == HTONS(DNS_CLASS_IN) &&
ans->len == HTONS(16) &&
- nameptr + 10 + 16 <= endofbuffer)
+ nameptr + DNS_ANSWER_HEADER_SIZE + 16 <= endofbuffer)
{
FAR struct sockaddr_in6 *inaddr;
- nameptr += 10 + 16;
+ nameptr += DNS_ANSWER_HEADER_SIZE + 16;
ninfo("IPv6 address: %04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x\n",
NTOHS(ans->u.ipv6.s6_addr16[0]),
@@ -785,7 +785,7 @@ static int dns_recv_response(int sd, FAR union dns_addr_u
*addr, int naddr,
else
#endif
{
- nameptr = nameptr + 10 + NTOHS(ans->len);
+ nameptr = nameptr + DNS_ANSWER_HEADER_SIZE + NTOHS(ans->len);
}
}
