[GH-ISSUE #1570] Name and its Decode impl disagree with the Encode impl on the length of some names #698

New issue

Closed

opened 2026-03-15 23:53:24 +03:00 by kerem · 1 comment

kerem commented

2026-03-15 23:53:24 +03:00

Owner

Originally created by @saethlin on GitHub (Oct 24, 2021).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/1570

I'm fuzzing trust-dns-proto per https://github.com/bluejekyll/trust-dns/issues/97. Hoping to get a few bugs out of the way before the fuzzing code gets checked in.

fn main() {
    let bytes = &[
        160, 160, 0, 12, 0, 0, 0, 0, 0, 2, 0, 1, 1, 1, 1, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25,
        25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25,
        25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25,
        25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25,
        25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 1, 34, 1, 34, 1, 9, 1, 1, 1, 1, 1, 1, 1, 1, 1,
        1, 1, 1, 1, 1, 9, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25,
        25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25,
        25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25,
        25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25,
        25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 1, 34, 1,
        1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 12, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0,
        0, 0, 1, 1, 1, 1, 1, 0, 0, 0, 0, 16, 0, 1, 0, 0, 1, 38, 0, 0, 0, 0, 16, 0, 1, 0, 255, 0,
        45, 0, 0, 0, 0, 16, 0, 1, 0, 38, 0, 0, 0, 0, 160, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 35,
        0, 1, 0, 0, 0, 0, 0, 1, 47, 1, 1,
    ];
    use trust_dns_proto::serialize::binary::{BinDecodable, BinEncodable};
    let msg = trust_dns_proto::op::Message::from_bytes(bytes).unwrap();
    println!("{}", msg.name_servers()[0].name().len());
    msg.to_bytes().unwrap(); // oof
}

Outputs:

255
thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: ProtoError { kind: DomainNameTooLong(256) }', src/main.rs:21:20

Version:
Crate: proto
Version: 0.21.0.alpha.4, 63fdb84333

Originally created by @saethlin on GitHub (Oct 24, 2021). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/1570 I'm fuzzing `trust-dns-proto` per https://github.com/bluejekyll/trust-dns/issues/97. Hoping to get a few bugs out of the way before the fuzzing code gets checked in. ```rust fn main() { let bytes = &[ 160, 160, 0, 12, 0, 0, 0, 0, 0, 2, 0, 1, 1, 1, 1, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 1, 34, 1, 34, 1, 9, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 9, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 1, 34, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 12, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 1, 1, 1, 1, 1, 0, 0, 0, 0, 16, 0, 1, 0, 0, 1, 38, 0, 0, 0, 0, 16, 0, 1, 0, 255, 0, 45, 0, 0, 0, 0, 16, 0, 1, 0, 38, 0, 0, 0, 0, 160, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 35, 0, 1, 0, 0, 0, 0, 0, 1, 47, 1, 1, ]; use trust_dns_proto::serialize::binary::{BinDecodable, BinEncodable}; let msg = trust_dns_proto::op::Message::from_bytes(bytes).unwrap(); println!("{}", msg.name_servers()[0].name().len()); msg.to_bytes().unwrap(); // oof } ``` Outputs: ``` 255 thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: ProtoError { kind: DomainNameTooLong(256) }', src/main.rs:21:20 ``` **Version:** Crate: proto Version: 0.21.0.alpha.4, 63fdb8433346e8bb1c22a0f0aa0b3a1acf688ff6

kerem closed this issue

2026-03-15 23:53:29 +03:00

kerem commented

2026-03-15 23:53:35 +03:00

Author

Owner

@saethlin commented on GitHub (Oct 24, 2021):

I think this is because the failing length check doesn't account for the zero-length terminating label that's written directly above it:
github.com/bluejekyll/trust-dns@63fdb84333/crates/proto/src/rr/domain/name.rs (L651-L655)

@saethlin commented on GitHub (Oct 24, 2021): I _think_ this is because the failing length check doesn't account for the zero-length terminating label that's written directly above it: https://github.com/bluejekyll/trust-dns/blob/63fdb8433346e8bb1c22a0f0aa0b3a1acf688ff6/crates/proto/src/rr/domain/name.rs#L651-L655