| Subject: | invalid udp packet crashes net dns nameserver |
| Date: | Tue, 10 Dec 2013 12:38:34 -0800 |
| To: | bug-Net-DNS [...] rt.cpan.org |
| From: | Alex Krohn <alex [...] gt.net> |
Hi,
If I use the example implementation of Net::DNS::Nameserver found here:
http://search.cpan.org/dist/Net-DNS/lib/Net/DNS/Nameserver.pm#EXAMPLE
and run it and then send a malformed UDP packet, it crashes the
nameserver process:
alex@alex ~/Net-DNS-0.73 $ perl -Iblib/lib test.pl
Creating TCP socket 0.0.0.0#5353 - done.
Creating UDP socket 0.0.0.0#5353 - done.
Waiting for connections...
Waiting for connections...
Waiting for connections...
Waiting for connections...
Waiting for connections...
UDP connection from 127.0.0.1:57949 to 0.0.0.0
Error decoding query packet: corrupt wire-format data at blib/lib/Net/DNS/Packet.pm line 116.
ERROR: invalid packet
Can't call method "additional" on an undefined value at blib/lib/Net/DNS/Nameserver.pm line 433.
alex@alex ~/Net-DNS-0.73
Is this expected behavior? You can reproduce this with this simple bit:
my $sock = IO::Socket::INET->new(
Proto => 'udp',
PeerPort => 5353,
PeerAddr => '0.0.0.0',
) or die "Couldn't create socket: $!\n";
$sock->send('x')
or die "Couldn't send: $!\n";
Expectation would be to see the error decoding message, but nameserver
continues running. Proposed patch:
alex@alex ~/Net-DNS-0.73 $ diff -u lib/Net/DNS/Nameserver.pm blib/lib/Net/DNS/Nameserver.pm
--- lib/Net/DNS/Nameserver.pm 2013-11-29 05:24:51.000000000 -0800
+++ blib/lib/Net/DNS/Nameserver.pm 2013-12-10 12:37:00.352243620 -0800
@@ -430,8 +430,10 @@
sub max_udp_len {
my ( $self, $query ) = @_;
- for my $rr ( $query->additional ) {
- return $rr->size if $rr->type eq 'OPT';
+ if ($query) {
+ for my $rr ( $query->additional ) {
+ return $rr->size if $rr->type eq 'OPT';
+ }
}
return 512;
alex@alex ~/Net-DNS-0.73 $
Cheers,
Alex
--
Alex Krohn <alex@gt.net>