Patched code sample

import struct

# A custom exception class used by the library for context.
class IncomingDecodeError(Exception):
    pass

# A simplified representation of the zeroconf.Incoming class containing the fix.
# The vulnerability was that an attacker-controlled length could cause a read
# beyond the bounds of the received packet data. The fix is to validate
# the length against the remaining packet size before reading.
class FixedIncomingPacketParser:

    def __init__(self, data: bytes) -> None:
        self.offset = 0
        self._data = data
        self._data_len = len(data)

    def _read_character_string(self) -> bytes:
        """Reads a DNS character string where the first byte is the length."""
        length = self._data[self.offset]
        self.offset += 1

        # THE FIX: Validate the length from the packet against the packet's actual size.
        if self.offset + length > self._data_len:
            raise IncomingDecodeError(
                f'Character string of length {length} is too long for the remaining packet '
                f'{self._data_len - self.offset}'
            )

        result = self._data[self.offset : self.offset + length]
        self.offset += length
        return result

    def _read_string(self, length: int) -> bytes:
        """Reads a string of a given length (e.g., from a record's RDLENGTH)."""

        # THE FIX: Validate the externally-provided length against the packet's actual size.
        if self.offset + length > self._data_len:
            raise IncomingDecodeError(
                f'String of length {length} is too long for the remaining packet '
                f'{self._data_len - self.offset}'
            )

        result = self._data[self.offset : self.offset + length]
        self.offset += length
        return result