Justin item 4: check salt bounds.

diff --git a/host2str.c b/host2str.c
index c7df116f55ec47b0424a7f7aa80cb01fa56236b5..402212a04e87cdcfd74c237bde630804c2471e11 100644 (file)
--- a/host2str.c
+++ b/host2str.c
@@ -752,18 +752,14 @@ ldns_rdf2buffer_str_nsec3_salt(ldns_buffer *output, const ldns_rdf *rdf)
        uint8_t salt_pos;
 
        uint8_t *data = ldns_rdf_data(rdf);
-       size_t pos;
 
        salt_length = data[0];
-       /* todo: length check needed/possible? */
        /* from now there are variable length entries so remember pos */
-       pos = 1;
-       if (salt_length == 0) {
+       if (salt_length == 0 || ((size_t)salt_length)+1 > ldns_rdf_size(rdf)) {
                ldns_buffer_printf(output, "- ");
        } else {
                for (salt_pos = 0; salt_pos < salt_length; salt_pos++) {
                        ldns_buffer_printf(output, "%02x", data[1 + salt_pos]);
-                       pos++;
                }
                ldns_buffer_printf(output, " ");
        }