Skip to content

fix: add TXT record size guard (CVE-2026-48045) #1809

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
alor29 wants to merge 1 commit into
base: master
Choose a base branch
from
+24 −5
Open

fix: add TXT record size guard (CVE-2026-48045) #1809

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion .pre-commit-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# See https://pre-commit.com for more information
# See https://pre-commit.com/hooks.html for more hooks
exclude: "CHANGELOG.md"
default_stages: [pre-commit]
default_stages: [commit]

ci:
autofix_commit_msg: "chore(pre-commit.ci): auto fixes"
Expand Down Expand Up @@ -58,3 +58,10 @@ repos:
hooks:
- id: cython-lint
- id: double-quote-cython-strings
repos:
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v4.5.0
hooks:
- id: check-added-large-files
stages: [commit]

20 changes: 16 additions & 4 deletions src/zeroconf/_services/info.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -239,7 +239,14 @@ def __init__(
if isinstance(properties, bytes):
self._set_text(properties)
else:
self._set_properties(properties)
# Guard against oversized TXT records
if properties:
for key, value in properties.items():
if value is not None:
val_bytes = value if isinstance(value, bytes) else str(value).encode("utf-8")
if len(val_bytes) > 255: # DNS TXT record limit
raise ValueError("TXT record too large")
self._set_properties(properties or {})
self.host_ttl = host_ttl
self.other_ttl = other_ttl
self._new_records_futures: set[asyncio.Future] | None = None
Expand Down Expand Up @@ -411,16 +418,20 @@ def _set_properties(self, properties: dict[str | bytes, str | bytes | None]) ->
if isinstance(key, str):
key = key.encode("utf-8") # noqa: PLW2901
properties_contain_str = True

record = key
if value is not None:
if not isinstance(value, bytes):
value = str(value).encode("utf-8") # noqa: PLW2901
properties_contain_str = True
record += b"=" + value
if len(record) > 255:
raise ValueError("TXT record too large")

list_.append(record)
for item in list_:
result = b"".join((result, bytes((len(item),)), item))

for item in list_:
# Safe encoding only runs if guard passes
result += bytes((len(item),)) + item
if not properties_contain_str:
# If there are no str keys or values, we can use the properties
# as-is, without decoding them, otherwise calling
Expand All @@ -429,6 +440,7 @@ def _set_properties(self, properties: dict[str | bytes, str | bytes | None]) ->
self._properties = cast(dict[bytes, bytes | None], properties)
else:
self._properties = properties

self.text = result

def _set_text(self, text: bytes) -> None:
Expand Down
Loading