From 387b4c5e4c3fe654187c49db743efd0be41febaf Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Wed, 15 Jul 2026 02:28:09 +0200
Subject: [PATCH] dnsd: fix bounds check in `read_https_alpn_part()`

"The check `i > 256` permits `i == 256` to pass through. When `i` is
then cast to `uint8_t` in `blob_add(b, (uint8_t)i)`, the value wraps to
0, silently encoding a zero-length ALPN entry instead of rejecting it.
The condition should be `i > 255` (or equivalently `i >= 256`) to
correctly reject any length that does not fit in a single byte."

Reported by GitHub Code Quality

Follow-up to 86f1e5b3f6c90e453368fdf23c366c1d4a8c953b #21299

Closes #22420
---
 tests/server/dnsd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/server/dnsd.c b/tests/server/dnsd.c
index a9b869d771..9d460d9452 100644
--- a/tests/server/dnsd.c
+++ b/tests/server/dnsd.c
@@ -570,7 +570,7 @@ static int read_https_alpn_part(struct blob *b, struct Curl_str *str)
     if(str->str[i] == ',')
       break;
   }
-  if(i > 256)
+  if(i >= 256)
     return 1;
   if(blob_add(b, (uint8_t)i) || blob_addchars(b, str->str, i))
     return 1;