From: Mark Andrews <marka@isc.org>
Date: Tue, 19 May 2026 02:03:23 +0000 (+1000)
Subject: Check that a short PRIVATEDNS record is rejected
X-Git-Tag: v9.21.24~13^2~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f48d48027384d8c2210b5ce9e3eac7af101ead3d;p=thirdparty%2Fbind9.git

Check that a short PRIVATEDNS record is rejected

A bug in dns_name_fromwire meant that short PRIVATEDNS key
records where being accepted.  Test that this is no longer
the case.
---

diff --git a/tests/dns/rdata_test.c b/tests/dns/rdata_test.c
index aafa7e04523..84361b76066 100644
--- a/tests/dns/rdata_test.c
+++ b/tests/dns/rdata_test.c
@@ -2322,6 +2322,25 @@ ISC_RUN_TEST_IMPL(key) {
 
 	check_rdata(text_ok, wire_ok, NULL, false, dns_rdataclass_in,
 		    dns_rdatatype_key, sizeof(dns_rdata_key_t));
+
+	/*
+	 * A valid PRIVATEDNS record with an active region shorter than the
+	 * actual record length.  A bug in dns_name_fromwire meant that this
+	 * was previously accepted.
+	 */
+	unsigned char key[] = { 0x00, 0x00, 0x00, 253, 0x07, 'e', 'x',
+				'a',  'm',  'p',  'l', 'e',  0x00 };
+	unsigned char buf[sizeof(key)];
+	isc_buffer_t source, target;
+	isc_result_t result;
+
+	isc_buffer_init(&source, key, sizeof(key));
+	isc_buffer_add(&source, sizeof(key));
+	isc_buffer_setactive(&source, sizeof(key) - 1);
+	isc_buffer_init(&target, buf, sizeof(buf));
+	result = dns_rdata_fromwire(NULL, dns_rdataclass_in, dns_rdatatype_key,
+				    &source, DNS_DECOMPRESS_ALWAYS, &target);
+	assert_int_not_equal(result, ISC_R_SUCCESS);
 }
 
 /*