From: Mukund Sivaraman <muks@isc.org>
Date: Thu, 14 Mar 2013 02:11:58 +0000 (+0530)
Subject: [2387] Add key data size check in InputBuffer constructor too
X-Git-Tag: bind10-1.2.0beta1-release~481^2~45
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b6bd57985bbd40a4cd76e0b37c3e5ae7d3563051;p=thirdparty%2Fkea.git

[2387] Add key data size check in InputBuffer constructor too
---

diff --git a/src/lib/dns/rdata/generic/dnskey_48.cc b/src/lib/dns/rdata/generic/dnskey_48.cc
index f5b45c48b1..449a84f046 100644
--- a/src/lib/dns/rdata/generic/dnskey_48.cc
+++ b/src/lib/dns/rdata/generic/dnskey_48.cc
@@ -101,6 +101,12 @@ DNSKEY::DNSKEY(InputBuffer& buffer, size_t rdata_len) {
     vector<uint8_t> keydata(rdata_len);
     buffer.readData(&keydata[0], rdata_len);
 
+    // See RFC 4034 appendix B.1 for why the key data has to be at least
+    // 3 bytes long with RSA/MD5.
+    if (algorithm == 1 && keydata.size() < 3) {
+        isc_throw(InvalidRdataLength, "DNSKEY keydata too short");
+    }
+
     impl_ = new DNSKEYImpl(flags, protocol, algorithm, keydata);
 }