upstream/haproxy
1
0
Fork 0
mirror of https://github.com/haproxy/haproxy.git synced 2026-05-27 11:52:34 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

Revert "BUG/MEDIUM: dns: fix long loops in additional records parse on name failure"
Some checks are pending
Contrib / admin/halog/ (push) Waiting to run
Details
Contrib / dev/flags/ (push) Waiting to run
Details
Contrib / dev/haring/ (push) Waiting to run
Details
Contrib / dev/hpack/ (push) Waiting to run
Details
Contrib / dev/poll/ (push) Waiting to run
Details
VTest / Generate Build Matrix (push) Waiting to run
Details
VTest / (push) Blocked by required conditions
Details
Windows / Windows, gcc, all features (push) Waiting to run
Details

Browse source 
This reverts commit fefce297ab.

The commit broke the resolvers. All responses are marked as invalid. The
resolv_read_name() function can return 0 on error, but it seems also
possible to return 0 when no label name was found. And depending on the
caller, it can be an error... or not.

So, let's revert it. This might trigger a watchdog but doesn't seem to and
once fixed it makes things worse.

Must be backported as far as 2.4.
This commit is contained in:
Christopher Faulet 2026-05-27 15:37:35 +02:00
parent cd652efeca
commit 091768ab3e
1 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
src/resolvers.c
View file

@ -1420,7 +1420,7 @@ static int resolv_validate_dns_response(unsigned char *resp, unsigned char *bufe
len = resolv_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE,
&offset, 0);
if (len == 0)
goto invalid_resp;
continue;
if (reader + offset + 10 > bufend)
goto invalid_resp;
@ -1456,8 +1456,11 @@ static int resolv_validate_dns_response(unsigned char *resp, unsigned char *bufe
offset = 0;
len = resolv_read_name(resp, bufend, reader, tmpname, DNS_MAX_NAME_SIZE, &offset, 0);
if (len == 0)
goto invalid_resp;
if (len == 0) {
pool_free(resolv_answer_item_pool, answer_record);
answer_record = NULL;
continue;
}
memcpy(answer_record->name, tmpname, len);
answer_record->name[len] = 0;