• Fix stability issues in DoH daemon and event loop

[danielinux]

• Prevent OOB writes in request peek and non-H2 handling
• Handle non-fatal TLS handshake errors and EOF cleanly
• Avoid daemon exit on resolver send failure; fail request instead
• Harden DNS reply parsing for compressed/uncompressed names
• Add nghttp2 submit error handling to avoid hung streams
• Fix libevquick signal/timer safety and nonblocking pipe setup
• Guard resolver list overflow; improve cleanup/leak handling
• Align URL64 test signature and add forward declaration for build

[Copilot]

Pull request overview

This pull request addresses critical stability and security issues in the DoH (DNS-over-HTTPS) daemon and event loop library. The changes focus on preventing out-of-bounds writes, improving error handling for TLS and networking operations, and fixing DNS parsing logic to handle both compressed and uncompressed names.

Changes:

• Fixed buffer overflow vulnerabilities in DNS request peeking and HTTP/2 response handling
• Improved error handling for TLS handshake failures, resolver send failures, and nghttp2 operations
• Hardened DNS reply parsing with proper support for compressed/uncompressed domain names
• Fixed signal/timer safety and nonblocking pipe configuration in libevquick
• Added resolver list overflow protection

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
test/test_url64.c	Updated function signature and test code to align with implementation that returns decoded length directly
src/libevquick.c	Fixed fcntl nonblocking flag usage, improved signal handler safety, and added timer deletion cleanup
src/dohd.c	Added DNS name parsing functions, improved error handling throughout, prevented buffer overflows, and added resolver bounds checking

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.