From fabb538f1885a135e48a60de2e3c656d965e861d Mon Sep 17 00:00:00 2001 From: Kim Davies Date: Sun, 10 May 2026 12:44:47 -0700 Subject: [PATCH 2/3] Use valid_string_length() for early oversized-input check CVE: CVE-2026-45409 Upstream-Status: Backport [https://github.com/kjd/idna/commit/628fef84d3eda59321c21127e73dcd873db23ead] (cherry picked from commit 628fef84d3eda59321c21127e73dcd873db23ead) Signed-off-by: Hetvi Thakar --- idna/core.py | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/idna/core.py b/idna/core.py index a549326..4a9fc75 100644 --- a/idna/core.py +++ b/idna/core.py @@ -341,12 +341,9 @@ def encode(s: Union[str, bytes, bytearray], strict: bool = False, uts46: bool = if uts46: s = uts46_remap(s, std3_rules, transitional) - # Reject inputs that exceed the maximum DNS domain length up-front. - # Each codepoint in a U-label contributes at least one octet to its - # A-label form, so any input longer than the domain limit cannot - # produce a valid A-domain. Short-circuiting here prevents per-label - # validation from being driven into quadratic time - if len(s) > 254: + # Reject inputs that exceed the maximum DNS domain length up-front + # to avoid expensive computation on long inputs. + if not valid_string_length(s, trailing_dot=True): raise IDNAError("Domain too long") trailing_dot = False @@ -382,10 +379,9 @@ def decode(s: Union[str, bytes, bytearray], strict: bool = False, uts46: bool = raise IDNAError('Invalid ASCII in A-label') if uts46: s = uts46_remap(s, std3_rules, False) - # See encode() for rationale; the same bound applies because every - # legal A-domain is at most 254 octets and every codepoint of a - # legal U-domain contributes at least one octet to its A-form. - if len(s) > 254: + # Reject inputs that exceed the maximum DNS domain length up-front + # to avoid expensive computation on long inputs. + if not valid_string_length(s, trailing_dot=True): raise IDNAError("Domain too long") trailing_dot = False result = []