Merge pull request #15139 from omoerbeek/rec-bound-check-for-future

rec: check bounds of rcode stats counter index (safe right now)
PowerDNS · Feb 11, 2025 · 5569b42 · 5569b42
2 parents 9e5db7f + 8530269
commit 5569b42
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 4 deletions.
diff --git a/pdns/recursordist/lwres.hh b/pdns/recursordist/lwres.hh
@@ -79,10 +79,10 @@ public:
   }
 
   vector<DNSRecord> d_records;
+  uint32_t d_usec{0};
   int d_rcode{0};
   bool d_validpacket{false};
   bool d_aabit{false}, d_tcbit{false};
-  uint32_t d_usec{0};
   bool d_haveEDNS{false};
 };
 

diff --git a/pdns/recursordist/rec-tcounters.hh b/pdns/recursordist/rec-tcounters.hh
@@ -195,8 +195,8 @@ struct Counters
       }
       return *this;
     }
-    static const size_t numberoOfRCodes = 16;
-    std::array<uint64_t, numberoOfRCodes> rcodeCounters;
+    static const size_t numberOfRCodes = 16;
+    std::array<uint64_t, numberOfRCodes> rcodeCounters;
   };
   // An RCodes histogram
   RCodeCounters auth{};

diff --git a/pdns/recursordist/syncres.cc b/pdns/recursordist/syncres.cc
@@ -5552,7 +5552,9 @@ bool SyncRes::doResolveAtThisIP(const std::string& prefix, const DNSName& qname,
   }
 
   accountAuthLatency(lwr.d_usec, remoteIP.sin4.sin_family);
-  ++t_Counters.at(rec::RCode::auth).rcodeCounters.at(static_cast<uint8_t>(lwr.d_rcode));
+  if (lwr.d_rcode >= 0 && lwr.d_rcode < static_cast<decltype(lwr.d_rcode)>(t_Counters.at(rec::RCode::auth).rcodeCounters.size())) {
+    ++t_Counters.at(rec::RCode::auth).rcodeCounters.at(static_cast<uint8_t>(lwr.d_rcode));
+  }
 
   if (!dontThrottle) {
     dontThrottle = shouldNotThrottle(&nsName, &remoteIP);