Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

malformed query can cause assertion failure at encoder.rs:234 #2210

Open
rtmrtmrtmrtm opened this issue May 13, 2024 · 1 comment
Open

malformed query can cause assertion failure at encoder.rs:234 #2210

rtmrtmrtmrtm opened this issue May 13, 2024 · 1 comment

Comments

@rtmrtmrtmrtm
Copy link

If a client sends this DNS request to the hickory 0.24.0 DNS server:

08 00 00 00 00 01 00 00 00 00 00 00 c0 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00

i.e.:
08 00 ID
00 00 flags
00 01 QDCOUNT
00 00 ANCOUNT
00 00 NSCOUNT
00 00 ARCOUNT
c0 00 QNAME
00 00 QTYPE
00 00 QCLASS

hickory-dns fails the 2nd assert here while building the reply message
(really while remembering names for pointers):

pub fn slice_of(&self, start: usize, end: usize) -> &[u8] {
    assert!(start < self.offset);
    assert!(end <= self.buffer.len());
    &self.buffer.buffer()[start..end]
}

The name is eight bytes long, but the current message size (after the
current offset of 12) is only six, because QueriesEmitAndCount::emit()
stored just the six bytes of the original encoded query:

    encoder.emit_vec(self.cached_serialized)?;

So the assert fails.

I've attached a demo program that assumes something like this is
already running:

hickory-dns/target/debug/hickory-dns -d -c hickory-dns/tests/test-data/test_configs/example.toml -z hickory-dns/tests/test-data/test_configs/ -p 24141

hickory1a.txt

@djc
Copy link
Collaborator

djc commented May 14, 2024

Thanks for the report! Could you send your test case as a PR adding a unit test in crates/proto/src/rr/serialize/encoder.rs? Bonus points if you can also come up with a fix, but I can probably find some time to fix it myself. 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants