[exim] Re: dnsdb loses characters (exim 4.96.2, 4.97)

> On Wed, 15 Nov 2023, Victor Ustugov via Exim-users wrote:
> 
> > Hello
> > 
> > This is a real case.
> > 
> > Let's resolve the TXT record of the perrigo.com domain.
> > 
> > # pkg info -E exim
> > exim-4.96.2
> > 
> > # echo '${lookup dnsdb{>\n; defer_never,txt=perrigo.com}}' | exim -be |
> > grep v=spf1
> > v=spf1 include:spf-00157e01.pphosted.com
> > include:spf-00157e03.pphosted.com include:spf.protection.outlook.com
> > include:spf.natchcloud.com include:spf.messagelabs.com
> > include:spf.mailjet.com a:smtp5.silae.fr include:_spf-dc8.sapsf.co#
> > include:_spf-dc4.sapsf.com ip4:70.42.227.151/32 ip4:70.42.227.152/32
> > ip4:65.221.8.29/32 ip4:65.221.12.128/2 ip4:65.221.12.148/32
> > ip4:198.11.114.29/32 ~all
> 
> git bisect finds that
>     commit f6b1f8e7d642f82d830a71b78699a4349e0158e1
>     Date:   Tue Oct 10 23:03:28 2023 +0100
> 
>     Harden dnsdb against crafted DNS responses.  Bug 3033
> 
>     (cherry picked from commit 8787c8994f07c23c3664d76926e02f07314d699d)
> is to blame.
> 
> [ I note that the '#' in include:_spf-dc8.sapsf.co# is actually 0x9c. ]

That "9c" is the length of the second DNS character-string in the TXT
record.  A TXT record is a non-empty list of <character-string>, in
which each string is preceded by a one byte length (0–255).

    $ dig +short -t txt perrigo.com | grep 'spf1'
    "v=spf1 include:spf-00157e01.pphosted.com include:spf-00157e03.pphosted.com include:spf.protection.outlook.com include:spf.natchcloud.com include:spf.messagelabs.com include:spf.mailjet.com a:smtp5.silae.fr include:_spf-dc8.sapsf.com" " include:_spf-dc4.sapsf.com ip4:70.42.227.151/32 ip4:70.42.227.152/32 ip4:65.221.8.29/32 ip4:65.221.12.128/32 ip4:65.221.12.148/32 ip4:198.11.114.29/32 ~all"

    $ set -- "v=spf1 include:spf-00157e01.pphosted.com include:spf-00157e03.pphosted.com include:spf.protection.outlook.com include:spf.natchcloud.com include:spf.messagelabs.com include:spf.mailjet.com a:smtp5.silae.fr include:_spf-dc8.sapsf.com" " include:_spf-dc4.sapsf.com ip4:70.42.227.151/32 ip4:70.42.227.152/32 ip4:65.221.8.29/32 ip4:65.221.12.128/32 ip4:65.221.12.148/32 ip4:198.11.114.29/32 ~all"

    $ printf '%s' "$2" | wc -c
    156

    $ printf "%02x\n" $(printf '%s' "$2" | wc -c)
    9c
 
The (new) code that is processing the TXT record is failing to properly
handle multi-element TXT records.  Concatenation of the list elements
need to happen after removing the fragment length bytes.

-- 
    Viktor.