[PATCH] resolv: Count records, and check hostname (CVE-2026-4437, CVE-2026-4438)

[Collin Funk]

Carlos O'Donell <carlos@redhat.com> writes:

>>> +    /* Test for invalid UTF-8 characters (2-byte, 4-byte, 6-byte).  */
>>> +    { "Invalid use of UTF-8 (2-byte, U+00C0-U+00C2)",
>>> +      "ÁÂÃ.test.ptr.example", NO_RECOVERY, true },
>>> +    { "Invalid use of UTF-8 (4-byte, U+0750-U+0752)",
>>> +      "ݐݑݒ.test.ptr.example", NO_RECOVERY, true },
>>> +     { "Invalid use of UTF-8 (6-byte, U+0904-U+0906)",
>>> +      "ऄअआ.test.ptr.example", NO_RECOVERY, true },
>> The use of UTF-8 might be tricky to backport for some environments.
>
> Windows DNS claims to support UTF-8 characters in names:
> https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/naming-conventions-for-computer-domain-site-ou
>
> So I wanted to include a test that showed UTF-8 as invalid since our
> implementation doesn't currently support it.
>
> My preference is to leave them, and if they are difficult to backport we
> can revisit a simplified or alternate test that encodes them in a
> different way?

It is less readable, but what we do in Gnulib is just write the UTF-8
characters in bytes. For example, "ऄअआ" would be written as
"\xE0\xA4\x84\xE0\xA4\x85\xE0\xA4\x86".

Collin