zeroconf 0.149.7__tar.gz → 0.149.9__tar.gz

{zeroconf-0.149.7 → zeroconf-0.149.9}/CHANGELOG.md

@@ -2,6 +2,38 @@
 
 <!-- version list -->
 
+## v0.149.9 (2026-05-20)
+
+### Bug Fixes
+
+- Bound QuestionHistory size to prevent LAN-driven OOM
+  ([#1733](https://github.com/python-zeroconf/python-zeroconf/pull/1733),
+  [`0e5e637`](https://github.com/python-zeroconf/python-zeroconf/commit/0e5e637172ab7991e8e1f13be7e4e5d228ce8b8b))
+
+
+## v0.149.8 (2026-05-19)
+
+### Bug Fixes
+
+- Bound NSEC bitmap length against record end
+  ([#1731](https://github.com/python-zeroconf/python-zeroconf/pull/1731),
+  [`1d83550`](https://github.com/python-zeroconf/python-zeroconf/commit/1d83550c58ed0ea69b611a907cd4bdfcb2eef535))
+
+### Testing
+
+- Give IPv6-only loopback find() its own timeout
+  ([#1721](https://github.com/python-zeroconf/python-zeroconf/pull/1721),
+  [`fcd1ffb`](https://github.com/python-zeroconf/python-zeroconf/commit/fcd1ffb4af9b3b26bc0ecae30641251a4c9a4ba6))
+
+- Widen LOOPBACK_FIND_TIMEOUT under PyPy
+  ([#1742](https://github.com/python-zeroconf/python-zeroconf/pull/1742),
+  [`6924606`](https://github.com/python-zeroconf/python-zeroconf/commit/69246065085fa25f9baf20abbf0eaddcb4a4d88c))
+
+- Widen safety margin in test_response_aggregation_timings_multiple
+  ([#1737](https://github.com/python-zeroconf/python-zeroconf/pull/1737),
+  [`228af17`](https://github.com/python-zeroconf/python-zeroconf/commit/228af178657a70dd2e76420a8187345de6ede46f))
+
+
 ## v0.149.7 (2026-05-18)
 
 ### Bug Fixes

{zeroconf-0.149.7 → zeroconf-0.149.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: zeroconf
-Version: 0.149.7
+Version: 0.149.9
 Summary: A pure python implementation of multicast DNS service discovery
 License-Expression: LGPL-2.1-or-later
 License-File: COPYING

{zeroconf-0.149.7 → zeroconf-0.149.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "poetry.core.masonry.api"
 
 [project]
 name = "zeroconf"
-version = "0.149.7"
+version = "0.149.9"
 license = "LGPL-2.1-or-later"
 description = "A pure python implementation of multicast DNS service discovery"
 readme = "README.rst"
@@ -84,13 +84,13 @@ python = "^3.10"
 ifaddr = ">=0.1.7"
 
 [tool.poetry.group.dev.dependencies]
-pytest = ">=7.2,<9.0"
+pytest = ">=9.0.3,<10.0"
 pytest-cov = ">=4,<8"
-pytest-asyncio = ">=0.20.3,<1.3.0"
+pytest-asyncio = ">=1.3.0,<1.4.0"
 cython = "^3.2.4"
 setuptools = ">=65.6.3,<83.0.0"
 pytest-timeout = "^2.1.0"
-pytest-codspeed = ">=4.5.0,<5.0"
+pytest-codspeed = ">=5.0.2,<6.0"
 
 [tool.poetry.group.docs.dependencies]
 sphinx = "^7.4.7 || ^8.1.3"

{zeroconf-0.149.7 → zeroconf-0.149.9}/setup.py

@@ -19,7 +19,7 @@ install_requires = \
 
 setup_kwargs = {
     'name': 'zeroconf',
-    'version': '0.149.7',
+    'version': '0.149.9',
     'description': 'A pure python implementation of multicast DNS service discovery',
     'long_description': 'python-zeroconf\n===============\n\n.. image:: https://github.com/python-zeroconf/python-zeroconf/workflows/CI/badge.svg\n   :target: https://github.com/python-zeroconf/python-zeroconf?query=workflow%3ACI+branch%3Amaster\n\n.. image:: https://img.shields.io/pypi/v/zeroconf.svg\n    :target: https://pypi.python.org/pypi/zeroconf\n\n.. image:: https://codecov.io/gh/python-zeroconf/python-zeroconf/branch/master/graph/badge.svg\n   :target: https://codecov.io/gh/python-zeroconf/python-zeroconf\n\n.. image:: https://img.shields.io/endpoint?url=https://codspeed.io/badge.json\n   :target: https://codspeed.io/python-zeroconf/python-zeroconf\n   :alt: Codspeed.io status for python-zeroconf\n\n.. image:: https://readthedocs.org/projects/python-zeroconf/badge/?version=latest\n    :target: https://python-zeroconf.readthedocs.io/en/latest/?badge=latest\n    :alt: Documentation Status\n\n`Documentation <https://python-zeroconf.readthedocs.io/en/latest/>`_.\n\nThis is fork of pyzeroconf, Multicast DNS Service Discovery for Python,\noriginally by Paul Scott-Murphy (https://github.com/paulsm/pyzeroconf),\nmodified by William McBrine (https://github.com/wmcbrine/pyzeroconf).\n\nThe original William McBrine\'s fork note::\n\n    This fork is used in all of my TiVo-related projects: HME for Python\n    (and therefore HME/VLC), Network Remote, Remote Proxy, and pyTivo.\n    Before this, I was tracking the changes for zeroconf.py in three\n    separate repos. I figured I should have an authoritative source.\n\n    Although I make changes based on my experience with TiVos, I expect that\n    they\'re generally applicable. This version also includes patches found\n    on the now-defunct (?) Launchpad repo of pyzeroconf, and elsewhere\n    around the net -- not always well-documented, sorry.\n\nCompatible with:\n\n* Bonjour\n* Avahi\n\nCompared to some other Zeroconf/Bonjour/Avahi Python packages, python-zeroconf:\n\n* isn\'t tied to Bonjour or Avahi\n* doesn\'t use D-Bus\n* doesn\'t force you to use particular event loop or Twisted (asyncio is used under the hood but not required)\n* is pip-installable\n* has PyPI distribution\n* has an optional cython extension for performance (pure python is supported as well)\n\nPython compatibility\n--------------------\n\n* CPython 3.10+\n* PyPy 3.10+\n\nVersioning\n----------\n\nThis project uses semantic versioning.\n\nStatus\n------\n\nThis project is actively maintained.\n\nTraffic Reduction\n-----------------\n\nBefore version 0.32, most traffic reduction techniques described in https://datatracker.ietf.org/doc/html/rfc6762#section-7\nwhere not implemented which could lead to excessive network traffic.  It is highly recommended that version 0.32 or later\nis used if this is a concern.\n\nIPv6 support\n------------\n\nIPv6 support is relatively new and currently limited, specifically:\n\n* `InterfaceChoice.All` is an alias for `InterfaceChoice.Default` on non-POSIX\n  systems.\n* Dual-stack IPv6 sockets are used, which may not be supported everywhere (some\n  BSD variants do not have them).\n* Listening on localhost (`::1`) does not work. Help with understanding why is\n  appreciated.\n\nHow to get python-zeroconf?\n===========================\n\n* PyPI page https://pypi.org/project/zeroconf/\n* GitHub project https://github.com/python-zeroconf/python-zeroconf\n\nThe easiest way to install python-zeroconf is using pip::\n\n    pip install zeroconf\n\n\n\nHow do I use it?\n================\n\nHere\'s an example of browsing for a service:\n\n.. code-block:: python\n\n    from zeroconf import ServiceBrowser, ServiceListener, Zeroconf\n\n\n    class MyListener(ServiceListener):\n\n        def update_service(self, zc: Zeroconf, type_: str, name: str) -> None:\n            print(f"Service {name} updated")\n\n        def remove_service(self, zc: Zeroconf, type_: str, name: str) -> None:\n            print(f"Service {name} removed")\n\n        def add_service(self, zc: Zeroconf, type_: str, name: str) -> None:\n            info = zc.get_service_info(type_, name)\n            print(f"Service {name} added, service info: {info}")\n\n\n    zeroconf = Zeroconf()\n    listener = MyListener()\n    browser = ServiceBrowser(zeroconf, "_http._tcp.local.", listener)\n    try:\n        input("Press enter to exit...\\n\\n")\n    finally:\n        zeroconf.close()\n\n.. note::\n\n    Discovery and service registration use *all* available network interfaces by default.\n    If you want to customize that you need to specify ``interfaces`` argument when\n    constructing ``Zeroconf`` object (see the code for details).\n\nIf you don\'t know the name of the service you need to browse for, try:\n\n.. code-block:: python\n\n    from zeroconf import ZeroconfServiceTypes\n    print(\'\\n\'.join(ZeroconfServiceTypes.find()))\n\nSee examples directory for more.\n\nChangelog\n=========\n\n`Changelog <CHANGELOG.md>`_\n\nLicense\n=======\n\nLGPL, see COPYING file for details.\n',
     'author': 'Paul Scott-Murphy',

{zeroconf-0.149.7 → zeroconf-0.149.9}/src/zeroconf/__init__.py

@@ -88,7 +88,7 @@ from ._utils.time import (  # noqa # import needed for backwards compat
 
 __author__ = "Paul Scott-Murphy, William McBrine"
 __maintainer__ = "Jakub Stasiak <jakub@stasiak.at>"
-__version__ = "0.149.7"
+__version__ = "0.149.9"
 __license__ = "LGPL"
 
 

{zeroconf-0.149.7 → zeroconf-0.149.9}/src/zeroconf/_history.pxd

@@ -4,13 +4,17 @@ from ._dns cimport DNSQuestion
 
 
 cdef cython.double _DUPLICATE_QUESTION_INTERVAL
+cdef unsigned int _MAX_QUESTION_HISTORY_ENTRIES
 
 cdef class QuestionHistory:
 
-    cdef cython.dict _history
+    cdef public cython.dict _history
 
     cpdef void add_question_at_time(self, DNSQuestion question, double now, cython.set known_answers)
 
+    @cython.locals(oldest=DNSQuestion, oldest_entry=cython.tuple, oldest_than=double)
+    cdef void _evict_to_make_room(self, double now)
+
     @cython.locals(than=double, previous_question=cython.tuple, previous_known_answers=cython.set)
     cpdef bint suppresses(self, DNSQuestion question, double now, cython.set known_answers)
 

{zeroconf-0.149.7 → zeroconf-0.149.9}/src/zeroconf/_history.py

@@ -23,7 +23,7 @@ USA
 from __future__ import annotations
 
 from ._dns import DNSQuestion, DNSRecord
-from .const import _DUPLICATE_QUESTION_INTERVAL
+from .const import _DUPLICATE_QUESTION_INTERVAL, _MAX_QUESTION_HISTORY_ENTRIES
 
 # The QuestionHistory is used to implement Duplicate Question Suppression
 # https://datatracker.ietf.org/doc/html/rfc6762#section-7.3
@@ -40,6 +40,8 @@ class QuestionHistory:
 
     def add_question_at_time(self, question: DNSQuestion, now: _float, known_answers: set[DNSRecord]) -> None:
         """Remember a question with known answers."""
+        if question not in self._history and len(self._history) >= _MAX_QUESTION_HISTORY_ENTRIES:
+            self._evict_to_make_room(now)
         self._history[question] = (now, known_answers)
 
     def suppresses(self, question: DNSQuestion, now: _float, known_answers: set[DNSRecord]) -> bool:
@@ -75,3 +77,19 @@ class QuestionHistory:
     def clear(self) -> None:
         """Clear the history."""
         self._history.clear()
+
+    def _evict_to_make_room(self, now: _float) -> None:
+        """Drop expired or oldest entries when the history is at cap.
+
+        Peeks at the oldest insertion (dict is ordered) — only runs the
+        full O(n) async_expire sweep if it could actually reclaim
+        something, else a sustained flood at cap turns each insert into
+        a wasted scan. Falls back to oldest-first eviction.
+        """
+        oldest = next(iter(self._history))
+        oldest_entry = self._history[oldest]
+        oldest_than = oldest_entry[0]
+        if now - oldest_than > _DUPLICATE_QUESTION_INTERVAL:
+            self.async_expire(now)
+        while len(self._history) >= _MAX_QUESTION_HISTORY_ENTRIES:
+            del self._history[next(iter(self._history))]

{zeroconf-0.149.7 → zeroconf-0.149.9}/src/zeroconf/_protocol/incoming.pxd

@@ -128,6 +128,7 @@ cdef class DNSIncoming:
         byte="unsigned int",
         i="unsigned int",
         bitmap_length="unsigned int",
+        bitmap_end="unsigned int",
     )
     cdef list _read_bitmap(self, unsigned int end)
 

{zeroconf-0.149.7 → zeroconf-0.149.9}/src/zeroconf/_protocol/incoming.py

@@ -388,9 +388,23 @@ class DNSIncoming:
             offset = self.offset
             offset_plus_one = offset + 1
             offset_plus_two = offset + 2
+            # RFC 4034 §4.1.2: each window block is window-number byte +
+            # bitmap-length byte (1..32) + bitmap. A bitmap_length that walks
+            # past the record's declared end would otherwise leave self.offset
+            # pointing inside (or past) the next record header, corrupting
+            # every subsequent record in the same packet.
+            if offset_plus_two > end:
+                raise IncomingDecodeError(
+                    f"NSEC bitmap window header truncated at offset {offset} from {self.source}"
+                )
             window = view[offset]
             bitmap_length = view[offset_plus_one]
             bitmap_end = offset_plus_two + bitmap_length
+            if bitmap_length == 0 or bitmap_length > 32 or bitmap_end > end:
+                raise IncomingDecodeError(
+                    f"NSEC bitmap length {bitmap_length} invalid or overruns record end "
+                    f"at offset {offset} from {self.source}"
+                )
             for i, byte in enumerate(self.data[offset_plus_two:bitmap_end]):
                 for bit in range(8):
                     if byte & (0x80 >> bit):

{zeroconf-0.149.7 → zeroconf-0.149.9}/src/zeroconf/const.py

@@ -65,6 +65,12 @@ _DNS_PTR_MIN_TTL = 1125
 # to retain by multicasting many unique-name records.
 _MAX_CACHE_RECORDS = 10000
 
+# Upper bound on the number of entries QuestionHistory will hold between
+# the periodic 10s cache-cleanup ticks. Bounds the memory a malicious LAN
+# peer can force the duplicate-question-suppression history to retain by
+# flooding distinct questions (RFC 6762 §7.3, defense-in-depth).
+_MAX_QUESTION_HISTORY_ENTRIES = 10000
+
 _DNS_PACKET_HEADER_LEN = 12
 
 _MAX_MSG_TYPICAL = 1460  # unused

{zeroconf-0.149.7 → zeroconf-0.149.9}/tests/__init__.py

@@ -23,6 +23,7 @@ USA
 from __future__ import annotations
 
 import asyncio
+import platform
 import socket
 import time
 from functools import cache
@@ -35,6 +36,8 @@ from zeroconf._history import QuestionHistory
 
 _MONOTONIC_RESOLUTION = time.get_clock_info("monotonic").resolution
 
+_IS_PYPY = platform.python_implementation() == "PyPy"
+
 # get_service_info / async_request timeout for tests using the
 # `quick_request_timing` fixture. The fixture cuts the initial-query
 # delay to ~15ms (10ms _LISTENER_TIME + 1-5ms jitter), so 50ms is
@@ -49,7 +52,17 @@ QUICK_REQUEST_TIMEOUT_MS = 50
 # the `quick_timing` fixture, which shrinks the browser's first-query
 # delay from RFC 6762 §5.2's 20-120ms window to 1-5ms; with that shave
 # the registrar's response lands inside ~10ms and 75ms is ~7x headroom.
-LOOPBACK_FIND_TIMEOUT = 0.075
+# PyPy's JIT is still warming up the first time this path runs early in
+# the suite, so the round trip is too slow for 75ms; give it more room.
+LOOPBACK_FIND_TIMEOUT = 0.3 if _IS_PYPY else 0.075
+
+# IPv6-only `find()` on Linux GitHub runners can hit `[Errno 101] Network
+# is unreachable` on the `::1` socket and falls back to the `fe80::` link-
+# local interface, which adds latency the IPv4 loopback path never pays.
+# PyPy widens that further with JIT warmup. The 75ms budget that works on
+# IPv4 loopback is too tight for the V6Only path under those conditions
+# — give it more headroom.
+IPV6_LOOPBACK_FIND_TIMEOUT = 0.5
 
 
 class QuestionHistoryWithoutSuppression(QuestionHistory):

{zeroconf-0.149.7 → zeroconf-0.149.9}/tests/services/test_types.py

@@ -11,7 +11,7 @@ import unittest
 import zeroconf as r
 from zeroconf import ServiceInfo, Zeroconf, ZeroconfServiceTypes
 
-from .. import LOOPBACK_FIND_TIMEOUT, _clear_cache, has_working_ipv6
+from .. import IPV6_LOOPBACK_FIND_TIMEOUT, LOOPBACK_FIND_TIMEOUT, _clear_cache, has_working_ipv6
 
 log = logging.getLogger("zeroconf")
 original_logging_level = logging.NOTSET
@@ -116,11 +116,11 @@ def test_integration_with_listener_ipv6(quick_timing, disable_duplicate_packet_s
     zeroconf_registrar.registry.async_add(info)
     try:
         service_types = ZeroconfServiceTypes.find(
-            ip_version=r.IPVersion.V6Only, timeout=LOOPBACK_FIND_TIMEOUT
+            ip_version=r.IPVersion.V6Only, timeout=IPV6_LOOPBACK_FIND_TIMEOUT
         )
         assert type_ in service_types
         _clear_cache(zeroconf_registrar)
-        service_types = ZeroconfServiceTypes.find(zc=zeroconf_registrar, timeout=LOOPBACK_FIND_TIMEOUT)
+        service_types = ZeroconfServiceTypes.find(zc=zeroconf_registrar, timeout=IPV6_LOOPBACK_FIND_TIMEOUT)
         assert type_ in service_types
 
     finally:

{zeroconf-0.149.7 → zeroconf-0.149.9}/tests/test_handlers.py

@@ -1783,19 +1783,19 @@ async def test_response_aggregation_timings_multiple(run_isolated, disable_dupli
         protocol.last_time = 0  # manually reset the last time to avoid duplicate packet suppression
         protocol.datagram_received(query2.packets()[0], ("127.0.0.1", const._MDNS_PORT))
         protocol.last_time = 0  # manually reset the last time to avoid duplicate packet suppression
-        # The delay should increase with two packets and
-        # 900ms is beyond the maximum aggregation delay
-        # when there is no network protection delay
-        await asyncio.sleep(0.9)
+        # The minimum protected send_after is 1000ms + 20ms random; sleep
+        # well under that so coarse timers on slow runners cannot push the
+        # send into this window and flake the assertion.
+        await asyncio.sleep(0.5)
         calls = send_mock.mock_calls
         assert len(calls) == 0
 
         # 1000ms  (1s network protection delays)
-        # - 900ms (already slept)
+        # - 500ms (already slept)
         # + 120ms (maximum random delay)
         # + 200ms (maximum protected aggregation delay)
         # +  20ms (execution time)
-        await asyncio.sleep(millis_to_seconds(1000 - 900 + 120 + 200 + 20))
+        await asyncio.sleep(millis_to_seconds(1000 - 500 + 120 + 200 + 20))
         calls = send_mock.mock_calls
         assert len(calls) == 1
         outgoing = send_mock.call_args[0][0]

{zeroconf-0.149.7 → zeroconf-0.149.9}/tests/test_history.py

@@ -78,3 +78,58 @@ def test_question_expire():
 
     # Verify the question not longer suppressed since the cache has expired
     assert not history.suppresses(question, now, other_known_answers)
+
+
+def test_question_history_bounded():
+    """History keeps a hard cap so a LAN flood cannot grow it without bound."""
+    history = QuestionHistory()
+    now = r.current_time_millis()
+    answers: set[r.DNSRecord] = set()
+
+    cap = const._MAX_QUESTION_HISTORY_ENTRIES
+    for i in range(cap + 500):
+        q = r.DNSQuestion(f"_svc{i}._tcp.local.", const._TYPE_PTR, const._CLASS_IN)
+        history.add_question_at_time(q, now, answers)
+
+    assert len(history._history) <= cap
+
+
+def test_question_history_evicts_oldest_first():
+    """When at cap, the oldest insertion is dropped first."""
+    history = QuestionHistory()
+    now = r.current_time_millis()
+    answers: set[r.DNSRecord] = set()
+
+    cap = const._MAX_QUESTION_HISTORY_ENTRIES
+    first = r.DNSQuestion("_first._tcp.local.", const._TYPE_PTR, const._CLASS_IN)
+    history.add_question_at_time(first, now, answers)
+
+    # Add `cap` more fresh, non-expired entries — one past the cap — so the
+    # final insertion forces oldest-first eviction of `first`.
+    for i in range(cap):
+        q = r.DNSQuestion(f"_svc{i}._tcp.local.", const._TYPE_PTR, const._CLASS_IN)
+        history.add_question_at_time(q, now, answers)
+
+    assert first not in history._history
+    assert len(history._history) <= cap
+
+
+def test_question_history_opportunistic_expire():
+    """Adding past the cap first drops expired entries before evicting fresh ones."""
+    history = QuestionHistory()
+    old = r.current_time_millis()
+    answers: set[r.DNSRecord] = set()
+
+    cap = const._MAX_QUESTION_HISTORY_ENTRIES
+    for i in range(cap):
+        q = r.DNSQuestion(f"_stale{i}._tcp.local.", const._TYPE_PTR, const._CLASS_IN)
+        history.add_question_at_time(q, old, answers)
+
+    # All prior entries are now stale (>999ms old). Adding one more should
+    # trigger opportunistic expiry rather than evicting only the oldest one.
+    fresh_now = old + const._DUPLICATE_QUESTION_INTERVAL + 1
+    fresh = r.DNSQuestion("_fresh._tcp.local.", const._TYPE_PTR, const._CLASS_IN)
+    history.add_question_at_time(fresh, fresh_now, answers)
+
+    assert fresh in history._history
+    assert len(history._history) == 1

{zeroconf-0.149.7 → zeroconf-0.149.9}/tests/test_protocol.py

@@ -807,6 +807,85 @@ def test_parse_packet_with_nsec_record():
     assert nsec_record.next_name == "MyHome54 (2)._meshcop._udp.local."
 
 
+def test_nsec_bitmap_length_overruns_record_end():
+    """Reject NSEC bitmap whose declared length runs past the record boundary."""
+    # 0 questions, 2 answers. Answer 1 is a malformed NSEC: rdlength=9, but the
+    # bitmap window claims length=255 — overrunning the record. Answer 2 is a
+    # PTR that must still parse because the offset for the next record stays
+    # pinned to the NSEC's declared end.
+    packet = (
+        b"\x00\x00\x84\x00\x00\x00\x00\x02\x00\x00\x00\x00"
+        b"\x04test\x05local\x00"
+        b"\x00\x2f\x80\x01"
+        b"\x00\x00\x11\x94"
+        b"\x00\x09"
+        b"\xc0\x0c"
+        b"\x00\xff"
+        b"\x80\x00\x00\x00\x00"
+        b"\xc0\x0c"
+        b"\x00\x0c\x00\x01"
+        b"\x00\x00\x11\x94"
+        b"\x00\x02"
+        b"\xc0\x0c"
+    )
+    parsed = r.DNSIncoming(packet)
+    answers = parsed.answers()
+    ptrs = [a for a in answers if isinstance(a, r.DNSPointer)]
+    assert len(ptrs) == 1
+    assert ptrs[0].alias == "test.local."
+    # The malformed NSEC must not surface — if it did, it would carry rdtypes
+    # synthesized from bytes past the record boundary.
+    assert not any(isinstance(a, r.DNSNsec) for a in answers)
+
+
+def test_nsec_bitmap_zero_length_window_rejected():
+    """A bitmap window with length=0 violates RFC 4034 §4.1.2 and must be rejected."""
+    packet = (
+        b"\x00\x00\x84\x00\x00\x00\x00\x02\x00\x00\x00\x00"
+        b"\x04test\x05local\x00"
+        b"\x00\x2f\x80\x01"
+        b"\x00\x00\x11\x94"
+        b"\x00\x04"
+        b"\xc0\x0c"
+        b"\x00\x00"
+        b"\xc0\x0c"
+        b"\x00\x0c\x00\x01"
+        b"\x00\x00\x11\x94"
+        b"\x00\x02"
+        b"\xc0\x0c"
+    )
+    parsed = r.DNSIncoming(packet)
+    answers = parsed.answers()
+    ptrs = [a for a in answers if isinstance(a, r.DNSPointer)]
+    assert len(ptrs) == 1
+    assert not any(isinstance(a, r.DNSNsec) for a in answers)
+
+
+def test_nsec_bitmap_truncated_window_header_rejected():
+    """Reject NSEC bitmap with a trailing byte too short to hold a window header."""
+    packet = (
+        b"\x00\x00\x84\x00\x00\x00\x00\x02\x00\x00\x00\x00"
+        b"\x04test\x05local\x00"
+        b"\x00\x2f\x80\x01"
+        b"\x00\x00\x11\x94"
+        b"\x00\x06"
+        b"\xc0\x0c"
+        b"\x00\x01\x80"
+        b"\xff"
+        b"\xc0\x0c"
+        b"\x00\x0c\x00\x01"
+        b"\x00\x00\x11\x94"
+        b"\x00\x02"
+        b"\xc0\x0c"
+    )
+    parsed = r.DNSIncoming(packet)
+    answers = parsed.answers()
+    ptrs = [a for a in answers if isinstance(a, r.DNSPointer)]
+    assert len(ptrs) == 1
+    assert ptrs[0].alias == "test.local."
+    assert not any(isinstance(a, r.DNSNsec) for a in answers)
+
+
 def test_records_same_packet_share_fate():
     """Test records in the same packet all have the same created time."""
     out = r.DNSOutgoing(const._FLAGS_QR_QUERY | const._FLAGS_AA)