Re: [PATCH 1/4] support: Add resolv_response_set_buffer

On 03/07/26 11:52, Florian Weimer wrote:
> This can be used to mangle the response data to exercise the
> DNS client with corrupted packets.
> 
> Also change resolv_response_buffer not to allocate.  Instead,
> just return a pointer to the internal buffer.  The function is
> currently unused.

LGTM, just a suggestion below.

Reviewed-by: Adhemerval Zanella  <[email protected]>

> ---
>  support/resolv_test.c | 17 +++++++++++++----
>  support/resolv_test.h | 15 +++++++++++++++
>  2 files changed, 28 insertions(+), 4 deletions(-)
> 
> diff --git a/support/resolv_test.c b/support/resolv_test.c
> index ec406b281a..4bb642f439 100644
> --- a/support/resolv_test.c
> +++ b/support/resolv_test.c
> @@ -429,11 +429,20 @@ resolv_response_length (const struct resolv_response_builder *b)
>  }
>  
>  unsigned char *
> -resolv_response_buffer (const struct resolv_response_builder *b)
> +resolv_response_buffer (struct resolv_response_builder *b)
>  {
> -  unsigned char *result = xmalloc (b->offset);
> -  memcpy (result, b->buffer, b->offset);
> -  return result;
> +  return b->buffer;
> +}
> +
> +void
> +resolv_response_set_buffer (struct resolv_response_builder *b,
> +                            const unsigned char *data, size_t length)
> +{
> +  if (length > max_response_length)
> +    FAIL_EXIT1 ("resolv_response_set_buffer: length %zu exceeds maximum %d",
> +                length, max_response_length);
> +  memmove (b->buffer, data, length);
> +  b->offset = length;

This does not update section, current_rdata_offset, or the compression_offsets so
the resolv_response_builder is left in an inconsistent state. Maybe either 
document it or fail for subsequent resolv_response_add_data.

>  }
>  
>  struct resolv_response_builder *
> diff --git a/support/resolv_test.h b/support/resolv_test.h
> index 7a81c1c513..c10c523eb4 100644
> --- a/support/resolv_test.h
> +++ b/support/resolv_test.h
> @@ -206,6 +206,21 @@ void resolv_response_close (struct resolv_response_builder *);
>  /* The size of the response packet built so far.  */
>  size_t resolv_response_length (const struct resolv_response_builder *);
>  
> +/* Return a pointer to the internal response buffer.  The pointer is
> +   only valid until the next call that modifies the builder.  The
> +   length of the byte array can be obtained using
> +   resolv_response_length.  */
> +unsigned char *resolv_response_buffer (struct resolv_response_builder *)
> +  __attribute_nonnull__ ((1));
> +
> +/* Replace the contents of the response buffer contents with a copy of
> +   LENGTH bytes starting at DATA.  Passing the pointer returned by
> +   resolv_response_buffer is valid.  If LENGTH is larger than the
> +   maximum support packet size, fail the process.  */
> +void resolv_response_set_buffer (struct resolv_response_builder *,
> +                                 const unsigned char *data, size_t length)
> +  __attribute_nonnull__ ((1, 2));
> +
>  /* Allocates a response builder tied to a specific query packet,
>     starting at QUERY_BUFFER, containing QUERY_LENGTH bytes.  */
>  struct resolv_response_builder *