Add regression tests for the decoder resource limits

Exercise MMDB_get_entry_data_list against the coordinated fixtures. The
value-count fan-out, the payload amplification, and its worst case under the
value-count limit are each rejected with MMDB_INVALID_DATA_ERROR and leave a
NULL output list. A normal record still decodes, confirming no false rejection,
and a rejected decode does not affect a later one, confirming the counters are
per call.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: oschwald

t/CMakeLists.txt

@@ -22,6 +22,7 @@ set(TEST_TARGET_NAMES
   metadata_t
   no_map_get_value_t
   overflow_bounds_t
+  pointer_dos_t
   read_node_t
   version_t
 )

t/Makefile.am

@@ -24,7 +24,7 @@ check_PROGRAMS = \
 	get_value_pointer_bug_t invalid_sockaddr_t \
 	ipv4_start_cache_t ipv6_lookup_in_ipv4_t max_depth_t metadata_t \
 	metadata_marker_t metadata_pointers_t no_map_get_value_t \
-	overflow_bounds_t read_node_t \
+	overflow_bounds_t pointer_dos_t read_node_t \
 	threads_t version_t
 
 data_pool_t_LDFLAGS = $(AM_LDFLAGS) -lm

t/pointer_dos_t.c

@@ -0,0 +1,143 @@
+#include "maxminddb_test_helper.h"
+
+/* Decoding a crafted fan-out record must be rejected, not run to exhaustion.
+ * The value-count and payload byte limits both surface as
+ * MMDB_INVALID_DATA_ERROR from MMDB_get_entry_data_list, and the output list
+ * must be left NULL. */
+static void test_fan_out_rejected(const char *fixture, const char *desc) {
+    char *db_file = test_database_path(fixture);
+
+    MMDB_s mmdb;
+    int status = MMDB_open(db_file, MMDB_MODE_MMAP, &mmdb);
+    cmp_ok(status, "==", MMDB_SUCCESS, "opened %s fixture", desc);
+    if (status != MMDB_SUCCESS) {
+        diag("MMDB_open failed: %s", MMDB_strerror(status));
+        free(db_file);
+        return;
+    }
+
+    int gai_error, mmdb_error;
+    MMDB_lookup_result_s result =
+        MMDB_lookup_string(&mmdb, "1.1.1.1", &gai_error, &mmdb_error);
+    cmp_ok(mmdb_error, "==", MMDB_SUCCESS, "%s: lookup succeeded", desc);
+    ok(result.found_entry, "%s: entry found", desc);
+
+    if (result.found_entry) {
+        MMDB_entry_data_list_s *entry_data_list = NULL;
+        status = MMDB_get_entry_data_list(&result.entry, &entry_data_list);
+        cmp_ok(status,
+               "==",
+               MMDB_INVALID_DATA_ERROR,
+               "%s: MMDB_get_entry_data_list returns MMDB_INVALID_DATA_ERROR",
+               desc);
+        ok(entry_data_list == NULL,
+           "%s: output list is NULL after the error",
+           desc);
+        MMDB_free_entry_data_list(entry_data_list);
+    }
+
+    MMDB_close(&mmdb);
+    free(db_file);
+}
+
+/* A normal record must still decode fully. Its payload is far below the limit,
+ * so the limits must not reject legitimate data. */
+static void test_normal_record_allowed(void) {
+    char *db_file = test_database_path("GeoIP2-City-Test.mmdb");
+
+    MMDB_s mmdb;
+    int status = MMDB_open(db_file, MMDB_MODE_MMAP, &mmdb);
+    cmp_ok(status, "==", MMDB_SUCCESS, "opened GeoIP2-City-Test");
+    if (status != MMDB_SUCCESS) {
+        diag("MMDB_open failed: %s", MMDB_strerror(status));
+        free(db_file);
+        return;
+    }
+
+    int gai_error, mmdb_error;
+    MMDB_lookup_result_s result =
+        MMDB_lookup_string(&mmdb, "81.2.69.142", &gai_error, &mmdb_error);
+    ok(result.found_entry, "normal record: entry found");
+
+    if (result.found_entry) {
+        MMDB_entry_data_list_s *entry_data_list = NULL;
+        status = MMDB_get_entry_data_list(&result.entry, &entry_data_list);
+        cmp_ok(status,
+               "==",
+               MMDB_SUCCESS,
+               "normal record decodes with no false rejection");
+        ok(entry_data_list != NULL, "normal record: list returned");
+        MMDB_free_entry_data_list(entry_data_list);
+    }
+
+    MMDB_close(&mmdb);
+    free(db_file);
+}
+
+/* The counters are per call. A rejected decode must not leave state that
+ * changes a later decode, on the same reader or another one. */
+static void test_per_call_state(void) {
+    char *dos_file =
+        test_database_path("MaxMind-DB-test-payload-amplification-dos.mmdb");
+    MMDB_s dos;
+    if (MMDB_open(dos_file, MMDB_MODE_MMAP, &dos) == MMDB_SUCCESS) {
+        int gai, err;
+        MMDB_lookup_result_s result =
+            MMDB_lookup_string(&dos, "1.1.1.1", &gai, &err);
+        if (result.found_entry) {
+            MMDB_entry_data_list_s *first = NULL;
+            int s1 = MMDB_get_entry_data_list(&result.entry, &first);
+            cmp_ok(s1,
+                   "==",
+                   MMDB_INVALID_DATA_ERROR,
+                   "per-call: first decode of the attack record is rejected");
+            MMDB_free_entry_data_list(first);
+
+            MMDB_entry_data_list_s *second = NULL;
+            int s2 = MMDB_get_entry_data_list(&result.entry, &second);
+            cmp_ok(s2,
+                   "==",
+                   MMDB_INVALID_DATA_ERROR,
+                   "per-call: repeating it is still rejected, no leaked count");
+            MMDB_free_entry_data_list(second);
+        }
+        MMDB_close(&dos);
+    }
+    free(dos_file);
+
+    char *ok_file = test_database_path("GeoIP2-City-Test.mmdb");
+    MMDB_s good;
+    if (MMDB_open(ok_file, MMDB_MODE_MMAP, &good) == MMDB_SUCCESS) {
+        int gai, err;
+        MMDB_lookup_result_s result =
+            MMDB_lookup_string(&good, "81.2.69.142", &gai, &err);
+        if (result.found_entry) {
+            MMDB_entry_data_list_s *list = NULL;
+            int status = MMDB_get_entry_data_list(&result.entry, &list);
+            cmp_ok(status,
+                   "==",
+                   MMDB_SUCCESS,
+                   "per-call: a valid decode after a rejected one still works");
+            MMDB_free_entry_data_list(list);
+        }
+        MMDB_close(&good);
+    }
+    free(ok_file);
+}
+
+int main(void) {
+    plan(NO_PLAN);
+    /* Value-count limit: nested arrays of pointers to shared targets. */
+    test_fan_out_rejected("MaxMind-DB-test-pointer-decoder-dos.mmdb",
+                          "value-count fan-out");
+    /* Payload byte limit: many pointers to one large string. */
+    test_fan_out_rejected("MaxMind-DB-test-payload-amplification-dos.mmdb",
+                          "payload amplification");
+    /* Worst case under the value-count limit, caught only by the byte limit. */
+    test_fan_out_rejected(
+        "MaxMind-DB-test-payload-amplification-dos-worst-case.mmdb",
+        "worst-case payload");
+    test_normal_record_allowed();
+    test_per_call_state();
+    done_testing();
+}