NSEC3PARAM: check that saltlen is consistent with the rdata length

diff --git a/lib/dns/rdata/generic/nsec3param_51.c b/lib/dns/rdata/generic/nsec3param_51.c
index a064d43cc6c4bcb617057d3489dfd2ca43e987d2..0ea3103f8e9695741b0cd03fa7982ceb413f8f51 100644 (file)
--- a/lib/dns/rdata/generic/nsec3param_51.c
+++ b/lib/dns/rdata/generic/nsec3param_51.c
@@ -160,7 +160,7 @@ fromwire_nsec3param(ARGS_FROMWIRE) {
        saltlen = sr.base[4];
        isc_region_consume(&sr, 5);
 
-       if (sr.length < saltlen) {
+       if (sr.length != saltlen) {
                RETERR(DNS_R_FORMERR);
        }
        isc_region_consume(&sr, saltlen);