Addressed copilot's comments

Author: danielinux

proxy/dohproxyd.c

@@ -508,6 +508,8 @@ static int tcp_connect(const char *host, const char *port)
     tv.tv_usec = 0;
 
     for (rp = res; rp; rp = rp->ai_next) {
+        if (!sockaddr_is_public(rp->ai_addr))
+            continue;
         fd = socket(rp->ai_family, rp->ai_socktype, rp->ai_protocol);
         if (fd < 0)
             continue;

src/dohd.c

@@ -505,6 +505,17 @@ static void handle_pending_signals(int __attribute__((unused)) fd,
     }
 }
 
+static int set_fd_nonblocking(int fd)
+{
+    int flags = fcntl(fd, F_GETFL, 0);
+
+    if (flags < 0)
+        return -1;
+    if ((flags & O_NONBLOCK) != 0)
+        return 0;
+    return fcntl(fd, F_SETFL, flags | O_NONBLOCK);
+}
+
 
 static void dohd_destroy_client(struct client_data *cd)
 {
@@ -1793,8 +1804,11 @@ int main(int argc, char *argv[])
         dohprint(DOH_ERR, "ERROR: failed to create signal pipe");
         return -1;
     }
-    fcntl(signal_pipe[0], F_SETFL, O_NONBLOCK);
-    fcntl(signal_pipe[1], F_SETFL, O_NONBLOCK);
+    if (set_fd_nonblocking(signal_pipe[0]) != 0 ||
+            set_fd_nonblocking(signal_pipe[1]) != 0) {
+        dohprint(DOH_ERR, "ERROR: failed to make signal pipe non-blocking");
+        return -1;
+    }
     evquick_addevent(signal_pipe[0], EVQUICK_EV_READ, handle_pending_signals, NULL, NULL);
 
     /* Initialize memory pools */

src/heap.h

@@ -36,11 +36,13 @@ static inline uint64_t heap_insert(struct heap_##type *heap, type *el)
                 (heap->n + 1) * sizeof(struct heap_element_##type));                    \
         if (!_tmp) {                                                                    \
             heap->n--;                                                                  \
-            return -1;                                                                  \
+            return UINT64_MAX;                                                          \
         }                                                                               \
         heap->top = _tmp;                                                               \
         heap->size++;                                                                   \
     }                                                                                   \
+    if (heap->last_id == UINT64_MAX)                                                    \
+        heap->last_id = 0;                                                              \
     etmp.id = heap->last_id++;                                                          \
     if (heap->n == 1) {                                                                 \
         memcpy(&heap->top[1], &etmp, sizeof(struct heap_element_##type));               \

src/url64.c

@@ -19,6 +19,7 @@
  */
 
 #include <inttypes.h>
+#include <limits.h>
 #include <stddef.h>
 
 static const unsigned char asciitable[256] = {
@@ -43,11 +44,16 @@ static const unsigned char asciitable[256] = {
 // returns an estimation of the length of the data once decoded
 int dohd_url64_declen(int len) { return ((len + 3) >> 2) * 3; }
 
+static size_t dohd_url64_declen_size(size_t len)
+{
+    return ((len + 3U) >> 2) * 3U;
+}
+
 int dohd_url64_check(const char *in, size_t in_len) {
     size_t c;
     const unsigned char *bufin;
 
-    if (!in)
+    if (!in || in_len > (size_t)INT_MAX)
         return 0;
     bufin = (const unsigned char *)in;
     for (c = 0; c < in_len; c++) {
@@ -66,9 +72,11 @@ int dohd_url64_decode(const char *src, size_t src_len, uint8_t *dest, size_t des
 
     if (!src || !dest || dest_cap == 0)
         return -1;
+    if (src_len > (size_t)INT_MAX)
+        return -1;
     if (dohd_url64_check(src, src_len) != (int)src_len)
         return -1;
-    if ((size_t)dohd_url64_declen((int)src_len) + 1 > dest_cap)
+    if (dohd_url64_declen_size(src_len) + 1 > dest_cap)
         return -1;
 
     bufin = _buf;

test/test_dns_parser.c

@@ -141,6 +141,8 @@ static uint32_t dnsreply_min_age(const void *p, size_t len) {
     for (i = 0; i < total_rr; i++) {
         uint32_t ttl;
         uint16_t datalen;
+        uint32_t ttl_net;
+        uint16_t datalen_net;
         size_t remain;
 
         if (dns_skip_rr_name(&record, end) < 0)
@@ -151,8 +153,10 @@ static uint32_t dnsreply_min_age(const void *p, size_t len) {
             return min_ttl;
 
         /* TYPE (2) + CLASS (2) + TTL (4) + RDLENGTH (2) = 10 bytes */
-        ttl = ntohl(*(uint32_t *)(record + 4));
-        datalen = ntohs(*(uint16_t *)(record + 8));
+        memcpy(&ttl_net, record + 4, sizeof(ttl_net));
+        memcpy(&datalen_net, record + 8, sizeof(datalen_net));
+        ttl = ntohl(ttl_net);
+        datalen = ntohs(datalen_net);
 
         if (remain < (size_t)(10 + datalen))
             return min_ttl;

test/test_heap.c

@@ -262,6 +262,20 @@ static int test_heap_id_wrap(void) {
     return 1;
 }
 
+static int test_heap_skips_error_sentinel(void) {
+    heap_test_timer *h = heap_init();
+    test_timer t = { .expire = 1, .value = 1 };
+    uint64_t id;
+
+    h->last_id = UINT64_MAX;
+    id = heap_insert(h, &t);
+    TEST_ASSERT(id == 0, "heap_insert skips UINT64_MAX sentinel");
+    TEST_ASSERT(h->last_id == 1, "heap_insert advances after sentinel wrap");
+
+    heap_destroy(h);
+    return 1;
+}
+
 int main(int argc, char **argv) {
     (void)argc;
     (void)argv;
@@ -279,6 +293,7 @@ int main(int argc, char **argv) {
     test_heap_stress();
     test_heap_growth();
     test_heap_id_wrap();
+    test_heap_skips_error_sentinel();
 
     fprintf(stderr, "\n=== Results: %d/%d tests passed ===\n", tests_passed, tests_run);