Do not invoke getRawLabels(0) unless countLabels() != 0.

diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
index fe3dc89b54654ec96a06d486edaaa189642d929e..440ddc13a614b370d5bd128291cc4f482f143713 100644 (file)
--- a/pdns/packethandler.cc
+++ b/pdns/packethandler.cc
@@ -1342,7 +1342,7 @@ void PacketHandler::completeANYRecords(DNSPacket& p, std::unique_ptr<DNSPacket>&
 
 bool PacketHandler::tryAuthSignal(DNSPacket& p, std::unique_ptr<DNSPacket>& r, DNSName &target) {
   DLOG(g_log<<Logger::Warning<<"Let's try authenticated DNSSEC bootstrapping (RFC 9615) ..."<<endl);
-  if(d_sd.zonename.operator const DNSName&().getRawLabel(0) != "_signal" || !d_dk.isSignalingZone(d_sd.zonename)) {
+  if(d_sd.zonename.operator const DNSName&().countLabels() == 0 || d_sd.zonename.operator const DNSName&().getRawLabel(0) != "_signal" || !d_dk.isSignalingZone(d_sd.zonename)) {
     return false;
   }
 
@@ -1358,7 +1358,7 @@ bool PacketHandler::tryAuthSignal(DNSPacket& p, std::unique_ptr<DNSPacket>& r, D
   }
 
   // Check for prefix mismatch
-  if(target.getRawLabel(0) != "_dsboot") {
+  if(target.countLabels() == 0 || target.getRawLabel(0) != "_dsboot") {
     makeNOError(p, r, target, DNSName(), 0); // could be ENT
     return true;
   }

diff --git a/pdns/pdnsutil.cc b/pdns/pdnsutil.cc
index 527c4b259b4d75090edb3b72d1dbc74e097463ed..336dca246234fc2f76aba58031ec15eeefcc6987 100644 (file)
--- a/pdns/pdnsutil.cc
+++ b/pdns/pdnsutil.cc
@@ -3681,7 +3681,7 @@ static int setSignalingZone(vector<string>& cmds, const std::string_view synopsi
 
   ZoneName zone(cmds.at(1));
 
-  if(zone.operator const DNSName&().getRawLabel(0) != "_signal") {
+  if(zone.operator const DNSName&().countLabels() == 0 || zone.operator const DNSName&().getRawLabel(0) != "_signal") {
     cerr << "Signaling zone's first label must be '_signal': " << zone << endl;
     return 1;
   }
@@ -5115,7 +5115,7 @@ static const std::unordered_map<std::string, commandDispatcher> commands{
   {"set-signaling-zone", {true, setSignalingZone, GROUP_CDNSKEY,
    "set-signaling-zone ZONE",
    "\tConfigure zone for RFC 9615 DNSSEC bootstrapping\n"
-   "(zone name must begin with _signal.)"}},
+   "\t(zone name must begin with _signal.)"}},
   {"show-zone", {true, showZone, GROUP_DNSSEC,
    "show-zone ZONE",
    "\tShow DNSSEC (public) key details about a zone"}},