From: Miod Vallat <miod.vallat@powerdns.com>
Date: Thu, 17 Jul 2025 05:37:30 +0000 (+0200)
Subject: Do not invoke getRawLabels(0) unless countLabels() != 0.
X-Git-Tag: rec-5.4.0-alpha0~21^2~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9b21c54b64b0a967f02126e2786ffe8a8a28c747;p=thirdparty%2Fpdns.git

Do not invoke getRawLabels(0) unless countLabels() != 0.
---

diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
index fe3dc89b54..440ddc13a6 100644
--- a/pdns/packethandler.cc
+++ b/pdns/packethandler.cc
@@ -1342,7 +1342,7 @@ void PacketHandler::completeANYRecords(DNSPacket& p, std::unique_ptr<DNSPacket>&
 
 bool PacketHandler::tryAuthSignal(DNSPacket& p, std::unique_ptr<DNSPacket>& r, DNSName &target) {
   DLOG(g_log<<Logger::Warning<<"Let's try authenticated DNSSEC bootstrapping (RFC 9615) ..."<<endl);
-  if(d_sd.zonename.operator const DNSName&().getRawLabel(0) != "_signal" || !d_dk.isSignalingZone(d_sd.zonename)) {
+  if(d_sd.zonename.operator const DNSName&().countLabels() == 0 || d_sd.zonename.operator const DNSName&().getRawLabel(0) != "_signal" || !d_dk.isSignalingZone(d_sd.zonename)) {
     return false;
   }
 
@@ -1358,7 +1358,7 @@ bool PacketHandler::tryAuthSignal(DNSPacket& p, std::unique_ptr<DNSPacket>& r, D
   }
 
   // Check for prefix mismatch
-  if(target.getRawLabel(0) != "_dsboot") {
+  if(target.countLabels() == 0 || target.getRawLabel(0) != "_dsboot") {
     makeNOError(p, r, target, DNSName(), 0); // could be ENT
     return true;
   }
diff --git a/pdns/pdnsutil.cc b/pdns/pdnsutil.cc
index 527c4b259b..336dca2462 100644
--- a/pdns/pdnsutil.cc
+++ b/pdns/pdnsutil.cc
@@ -3681,7 +3681,7 @@ static int setSignalingZone(vector<string>& cmds, const std::string_view synopsi
 
   ZoneName zone(cmds.at(1));
 
-  if(zone.operator const DNSName&().getRawLabel(0) != "_signal") {
+  if(zone.operator const DNSName&().countLabels() == 0 || zone.operator const DNSName&().getRawLabel(0) != "_signal") {
     cerr << "Signaling zone's first label must be '_signal': " << zone << endl;
     return 1;
   }
@@ -5115,7 +5115,7 @@ static const std::unordered_map<std::string, commandDispatcher> commands{
   {"set-signaling-zone", {true, setSignalingZone, GROUP_CDNSKEY,
    "set-signaling-zone ZONE",
    "\tConfigure zone for RFC 9615 DNSSEC bootstrapping\n"
-   "(zone name must begin with _signal.)"}},
+   "\t(zone name must begin with _signal.)"}},
   {"show-zone", {true, showZone, GROUP_DNSSEC,
    "show-zone ZONE",
    "\tShow DNSSEC (public) key details about a zone"}},