From: Mark Andrews <marka@isc.org>
Date: Fri, 15 May 2026 01:06:38 +0000 (+1000)
Subject: Add DNS_PRIVATE_BUFFERSIZE and use it
X-Git-Tag: v9.21.24~35^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5d7387b185726cd60181d18df12ef733588c9fc1;p=thirdparty%2Fbind9.git

Add DNS_PRIVATE_BUFFERSIZE and use it

The size of a private records is 1 byte more than the corresponding
NSEC3PARAM record.
---

diff --git a/lib/dns/include/dns/private.h b/lib/dns/include/dns/private.h
index 8f3d5a32ad5..883ddc746ac 100644
--- a/lib/dns/include/dns/private.h
+++ b/lib/dns/include/dns/private.h
@@ -16,8 +16,15 @@
 #include <isc/types.h>
 
 #include <dns/db.h>
+#include <dns/nsec.h>
 #include <dns/types.h>
 
+/*
+ * The private record has one extra byte, containing a 0, in front of
+ * an NSEC3PARAM record.
+ */
+#define DNS_PRIVATE_BUFFERSIZE (DNS_NSEC3PARAM_BUFFERSIZE + 1)
+
 #pragma once
 
 isc_result_t
diff --git a/lib/dns/nsec3.c b/lib/dns/nsec3.c
index e889b877c29..6b8d3b8f522 100644
--- a/lib/dns/nsec3.c
+++ b/lib/dns/nsec3.c
@@ -32,6 +32,7 @@
 #include <dns/fixedname.h>
 #include <dns/nsec.h>
 #include <dns/nsec3.h>
+#include <dns/private.h>
 #include <dns/rdata.h>
 #include <dns/rdatalist.h>
 #include <dns/rdataset.h>
@@ -1064,7 +1065,7 @@ dns_nsec3param_deletechains(dns_db_t *db, dns_dbversion_t *ver,
 	dns_rdataset_t rdataset;
 	bool flag;
 	isc_result_t result = ISC_R_SUCCESS;
-	unsigned char buf[DNS_NSEC3PARAM_BUFFERSIZE + 1];
+	unsigned char buf[DNS_PRIVATE_BUFFERSIZE];
 	dns_name_t *origin = dns_zone_getorigin(zone);
 	dns_rdatatype_t privatetype = dns_zone_getprivatetype(zone);
 
diff --git a/lib/ns/update.c b/lib/ns/update.c
index 12bcf5a2c14..7cfc75dbe1c 100644
--- a/lib/ns/update.c
+++ b/lib/ns/update.c
@@ -2323,7 +2323,7 @@ add_nsec3param_records(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	isc_result_t result = ISC_R_SUCCESS;
 	dns_difftuple_t *newtuple = NULL;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
-	unsigned char buf[DNS_NSEC3PARAM_BUFFERSIZE + 1];
+	unsigned char buf[DNS_PRIVATE_BUFFERSIZE];
 	dns_diff_t temp_diff;
 	dns_diffop_t op;
 	bool flag;
diff --git a/tests/dns/private_test.c b/tests/dns/private_test.c
index ff851996a3e..c4669ced4e3 100644
--- a/tests/dns/private_test.c
+++ b/tests/dns/private_test.c
@@ -74,7 +74,7 @@ make_signing(signing_testcase_t *testcase, dns_rdata_t *private,
 
 static void
 make_nsec3(nsec3_testcase_t *testcase, dns_rdata_t *private,
-	   unsigned char *pbuf) {
+	   unsigned char *pbuf, size_t pbufsize) {
 	isc_result_t result;
 	dns_rdata_nsec3param_t params;
 	dns_rdata_t nsec3param = DNS_RDATA_INIT;
@@ -119,7 +119,7 @@ make_nsec3(nsec3_testcase_t *testcase, dns_rdata_t *private,
 	dns_rdata_init(private);
 
 	dns_nsec3param_toprivate(&nsec3param, private, privatetype, pbuf,
-				 DNS_NSEC3PARAM_BUFFERSIZE + 1);
+				 pbufsize);
 }
 
 /* convert private signing records to text */
@@ -179,13 +179,13 @@ ISC_RUN_TEST_IMPL(private_nsec3_totext) {
 	UNUSED(state);
 
 	for (i = 0; i < ncases; i++) {
-		unsigned char data[DNS_NSEC3PARAM_BUFFERSIZE + 1];
+		unsigned char data[DNS_PRIVATE_BUFFERSIZE];
 		char output[BUFSIZ];
 		isc_buffer_t buf;
 
 		isc_buffer_init(&buf, output, sizeof(output));
 
-		make_nsec3(&testcases[i], &private, data);
+		make_nsec3(&testcases[i], &private, data, sizeof(data));
 		dns_private_totext(&private, &buf);
 		assert_string_equal(output, results[i]);
 	}