From cde34cac9d87c37b33c19eede3ed49ac3f465a18 Mon Sep 17 00:00:00 2001
From: Yusuke Endoh <mame@ruby-lang.org>
Date: Tue, 8 Jul 2025 16:19:30 +0900
Subject: [PATCH] Limit decompressed name length

RFC 1035 specifies the 255-octet maximum name length. This change set
checks the limit.
---
 lib/resolv.rb           | 6 +++++-
 test/resolv/test_dns.rb | 7 +++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/lib/resolv.rb b/lib/resolv.rb
index 61c9c7d..eaea69b 100644
--- a/lib/resolv.rb
+++ b/lib/resolv.rb
@@ -1624,6 +1624,7 @@ def get_labels
           prev_index = @index
           save_index = nil
           d = []
+          size = -1
           while true
             raise DecodeError.new("limit exceeded") if @limit <= @index
             case @data.getbyte(@index)
@@ -1644,7 +1645,10 @@ def get_labels
               end
               @index = idx
             else
-              d << self.get_label
+              l = self.get_label
+              d << l
+              size += 1 + l.string.bytesize
+              raise DecodeError.new("name label data exceed 255 octets") if size > 255
             end
           end
         end
diff --git a/test/resolv/test_dns.rb b/test/resolv/test_dns.rb
index 9d243bb..93a7042 100644
--- a/test/resolv/test_dns.rb
+++ b/test/resolv/test_dns.rb
@@ -416,6 +416,13 @@ def test_too_big_label_address
     assert_operator(2**14, :<, m.to_s.length)
   end
 
+  def test_too_long_address
+    too_long_address_message = [0, 0, 1, 0, 0, 0].pack("n*") + "\x01x" * 129 + [0, 0, 0].pack("cnn")
+    assert_raise_with_message(Resolv::DNS::DecodeError, /name label data exceed 255 octets/) do
+      Resolv::DNS::Message.decode too_long_address_message
+    end
+  end
+
   def assert_no_fd_leak
     socket = assert_throw(self) do |tag|
       Resolv::DNS.stub(:bind_random_port, ->(s, *) {throw(tag, s)}) do