From 17d975cf6c64fef4fed4e4a6a91a742202adfb86 Mon Sep 17 00:00:00 2001
From: Toni <antpiasecki@gmail.com>
Date: Tue, 21 Jul 2026 11:44:45 +0200
Subject: [PATCH] replace panic recovery with actual bounds checks

---
 main.go | 34 ++++++++++++++++++++--------------
 1 file changed, 20 insertions(+), 14 deletions(-)

diff --git a/main.go b/main.go
index f79077b..0663a19 100644
--- a/main.go
+++ b/main.go
@@ -62,7 +62,10 @@ func main() {
 			continue
 		}
 
-		go handleUDP(listener, req[:n], addr)
+		resp := handleReq(addr.IP.String(), req[:n])
+		if _, err := listener.WriteToUDP(resp, addr); err != nil {
+			fmt.Println(err)
+		}
 	}
 }
 
@@ -101,39 +104,42 @@ func handleHTTP(w http.ResponseWriter, r *http.Request) {
 	w.Write(resp)
 }
 
-func handleUDP(listener *net.UDPConn, req []byte, addr *net.UDPAddr) {
-	resp := handleReq(addr.IP.String(), req)
-	if _, err := listener.WriteToUDP(resp, addr); err != nil {
-		fmt.Println(err)
-	}
-}
-
 func handleReq(ip string, req []byte) []byte {
-	defer func() {
-		if r := recover(); r != nil {
-			fmt.Printf("Recovered from panic: CLIENT=%s: %v\n", ip, r)
-		}
-	}()
-
 	// we assume that QDCOUNT=1 but i think that's reasonable
 
+	if len(req) < 12 {
+		return nil
+	}
+
 	// https://datatracker.ietf.org/doc/html/rfc1035#section-4.1.2
 	// TODO: we should probably handle compression but from what i know clients don't generally use it
 	labels := []string{}
 	offset := 12
 	for {
+		if offset >= len(req) {
+			return nil
+		}
 		length := int(req[offset])
 		offset++
 		if length == 0 || length > 63 {
 			break
 		}
+		if offset+length > len(req) {
+			return nil
+		}
 		labels = append(labels, string(req[offset:offset+length]))
 		offset += length
 	}
+	if offset > len(req) {
+		return nil
+	}
 	rawName := req[12:offset]
 	name := strings.ToLower(strings.Join(labels, "."))
 
 	// https://datatracker.ietf.org/doc/html/rfc1035#section-3.2.2
+	if offset+4 > len(req) {
+		return nil
+	}
 	questionType := binary.BigEndian.Uint16(req[offset:])
 	offset += 2
 	// https://datatracker.ietf.org/doc/html/rfc1035#section-3.2.4