{"record":{"id":"1c998550aaa44dd3","repo":"txthinking/brook","slug":"dst-too-long","errorCode":null,"errorMessage":"dst too long","messagePattern":"dst too long","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"simplestreamclient.go","lineNumber":41,"sourceCode":"\n\t\"github.com/txthinking/socks5\"\n\t\"github.com/txthinking/x\"\n)\n\ntype SimpleStreamClient struct {\n\tServer  net.Conn\n\tTimeout int\n\tRB      []byte\n\tWB      []byte\n\tnetwork string\n\tsrc     string\n\tdst     string\n}\n\nfunc NewSimpleStreamClient(network string, password []byte, src string, server net.Conn, timeout int, dst []byte) (Exchanger, error) {\n\tc := &SimpleStreamClient{network: network, Server: server, Timeout: timeout, src: src, dst: socks5.ToAddress(dst[0], dst[1:len(dst)-2], dst[len(dst)-2:])}\n\tif len(dst) > 2048-32-2-4 {\n\t\treturn nil, errors.New(\"dst too long\")\n\t}\n\tb := x.BP2048.Get().([]byte)\n\tbinary.BigEndian.PutUint16(b[32:32+2], uint16(4+len(dst)))\n\ti := time.Now().Unix()\n\tif c.network == \"tcp\" && i%2 != 0 {\n\t\ti += 1\n\t}\n\tif c.network == \"udp\" && i%2 != 1 {\n\t\ti += 1\n\t}\n\tbinary.BigEndian.PutUint32(b[32+2:32+2+4], uint32(i))\n\tcopy(b[:32], password)\n\tcopy(b[32+2+4:], dst)\n\tif _, err := server.Write(b[:32+2+4+len(dst)]); err != nil {\n\t\tx.BP2048.Put(b)\n\t\treturn nil, err\n\t}\n\tif c.network == \"tcp\" {","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/txthinking/brook/blob/5cd13ef3b1fb574e88ebf2c1b5d95f2ebe1342c8/simplestreamclient.go#L23-L59","documentation":"NewSimpleStreamClient rejects a destination address whose encoded length exceeds 2048-32-2-4 (2010) bytes, because the fixed 2048-byte handshake buffer must hold the 32-byte password hash, 2-byte length prefix, 4-byte timestamp, and the dst address. dst longer than that would overflow the buffer, so the constructor fails fast.","triggerScenarios":"Calling NewSimpleStreamClient (directly or via CreateExchanger/TCPHandle/UDPHandle) with a dst byte slice that, after socks5.ToAddress encoding, is longer than 2010 bytes — typically a very long hostname or an oversized crafted address blob.","commonSituations":"Proxying to hosts with abnormally long DNS names (near the 253-char DNS limit times overhead is still fine — real cases come from malformed/corrupt upstream address bytes or hostile clients sending giant address fields).","solutions":["Shorten the destination hostname or use an IP address literal instead of a very long name","Validate/limit the dst address length before constructing the client and reject oversized requests earlier","Check that dst bytes are a well-formed SOCKS5 address (ATYP + addr + port); a malformed slice with trailing garbage inflates the length","If legitimate long destinations are required, use a protocol variant with a larger buffer"],"exampleFix":"// before\nif len(dst) > 2048 { /* no check, just send */ }\n// after\nif len(dst) > 2048-32-2-4 {\n    return nil, errors.New(\"dst too long\")\n}\ncl, err := NewSimpleStreamClient(network, password, src, server, timeout, dst)","handlingStrategy":"validation","validationCode":"if len(dst) > 2048-32-2-4 {\n    return fmt.Errorf(\"destination address too long: %d bytes (max %d)\", len(dst), 2048-32-2-4)\n}","typeGuard":null,"tryCatchPattern":"cl, err := NewSimpleStreamClient(network, password, src, server, timeout, dst)\nif err != nil {\n    if err.Error() == \"dst too long\" {\n        return nil, fmt.Errorf(\"cannot proxy to %q: address exceeds protocol limit\", dst)\n    }\n    return nil, err\n}","preventionTips":["Validate SOCKS5 address encoding before constructing the client","Prefer IP literals or reasonably short hostnames","Reject oversized destinations at the proxy front-end before dialing upstream"],"tags":["network","validation","socks5","buffer-limit"],"backgroundTag":"payload-too-large","analyzedSha":"5cd13ef3b1fb574e88ebf2c1b5d95f2ebe1342c8","analyzedAt":"2026-09-06T04:35:00.432Z","contentChangedAt":"2026-09-06T04:35:00.432Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}