Infinite loop possible in label parsing

[willscott]

Packet demonstrating this behavior:

var bin = new Buffer('1c5b818000010001000000000f636f6e74656e740264650000010001c00c000100010001517e0004d43e4dcd', 'hex');
var dns = require('native-dns-packet');
dns.parse(bin);

Looks like the packet has a corrupted / malicious label, with a continuation pointer back to itself.

In particular, the loop happens on the question label beginning at offset 12.

[maxmouchet]

The following patch fixes it, inspired by kapetan/dns#87:

diff --git a/packet.js b/packet.js
index 56b17d9..d8b5c07 100644
--- a/packet.js
+++ b/packet.js
@@ -71,11 +71,17 @@ function nameUnpack(buff) {
   comp = false;
   end = buff.tell();
 
+  var visited = new Set();
+
   while (len !== 0) {
     if (isPointer(len)) {
       len -= LABEL_POINTER;
       len = len << 8;
       pos = len + buff.readUInt8();
+      if (visited.has(pos)) {
+	     throw new Error('loop detected while unpacking name');
+      }
+      visited.add(pos);
       if (!comp)
         end = buff.tell();
       buff.seek(pos);