From: Mukund Sivaraman <muks@isc.org>
Date: Thu, 14 Mar 2013 02:30:14 +0000 (+0530)
Subject: [2387] Make DNSKEY wire constructor throw on empty keydata
X-Git-Tag: bind10-1.2.0beta1-release~481^2~44
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=46cfb5cccadfaaea4568d8478c3ba349c9b877dd;p=thirdparty%2Fkea.git

[2387] Make DNSKEY wire constructor throw on empty keydata
---

diff --git a/src/lib/dns/rdata/generic/dnskey_48.cc b/src/lib/dns/rdata/generic/dnskey_48.cc
index 449a84f046..2cba1be2ed 100644
--- a/src/lib/dns/rdata/generic/dnskey_48.cc
+++ b/src/lib/dns/rdata/generic/dnskey_48.cc
@@ -98,6 +98,12 @@ DNSKEY::DNSKEY(InputBuffer& buffer, size_t rdata_len) {
     const uint16_t algorithm = buffer.readUint8();
 
     rdata_len -= 4;
+    // Though the size of the public key is algorithm-dependent, we
+    // assume that it should not be empty.
+    if (rdata_len < 1) {
+        isc_throw(InvalidRdataLength, "DNSKEY keydata too short");
+    }
+
     vector<uint8_t> keydata(rdata_len);
     buffer.readData(&keydata[0], rdata_len);
 
diff --git a/src/lib/dns/tests/rdata_dnskey_unittest.cc b/src/lib/dns/tests/rdata_dnskey_unittest.cc
index f175c87c53..9676cd9d08 100644
--- a/src/lib/dns/tests/rdata_dnskey_unittest.cc
+++ b/src/lib/dns/tests/rdata_dnskey_unittest.cc
@@ -134,6 +134,10 @@ TEST_F(Rdata_DNSKEY_Test, createFromWire) {
     EXPECT_EQ(0, rdata_dnskey.compare(
                   *rdataFactoryFromFile(RRType("DNSKEY"), RRClass("IN"),
                                         "rdata_dnskey_fromWire")));
+    // Empty keydata should throw
+    EXPECT_THROW(rdataFactoryFromFile(RRType("DNSKEY"), RRClass("IN"),
+                                      "rdata_dnskey_empty_keydata_fromWire"),
+                 InvalidRdataLength);
 }
 
 TEST_F(Rdata_DNSKEY_Test, getTag) {
diff --git a/src/lib/dns/tests/testdata/Makefile.am b/src/lib/dns/tests/testdata/Makefile.am
index 52acb7c110..eee2e16ca3 100644
--- a/src/lib/dns/tests/testdata/Makefile.am
+++ b/src/lib/dns/tests/testdata/Makefile.am
@@ -101,7 +101,8 @@ EXTRA_DIST += name_toWire7 name_toWire8 name_toWire9
 EXTRA_DIST += question_fromWire question_toWire1 question_toWire2
 EXTRA_DIST += rdatafields1.spec rdatafields2.spec rdatafields3.spec
 EXTRA_DIST += rdatafields4.spec rdatafields5.spec rdatafields6.spec
-EXTRA_DIST += rdata_cname_fromWire rdata_dname_fromWire rdata_dnskey_fromWire
+EXTRA_DIST += rdata_cname_fromWire rdata_dname_fromWire
+EXTRA_DIST += rdata_dnskey_fromWire rdata_dnskey_empty_keydata_fromWire
 EXTRA_DIST += rdata_dhcid_fromWire rdata_dhcid_toWire
 EXTRA_DIST += rdata_ds_fromWire rdata_in_a_fromWire rdata_in_aaaa_fromWire
 EXTRA_DIST += rdata_mx_fromWire rdata_mx_toWire1 rdata_mx_toWire2
diff --git a/src/lib/dns/tests/testdata/rdata_dnskey_empty_keydata_fromWire b/src/lib/dns/tests/testdata/rdata_dnskey_empty_keydata_fromWire
new file mode 100644
index 0000000000..cd07bae051
--- /dev/null
+++ b/src/lib/dns/tests/testdata/rdata_dnskey_empty_keydata_fromWire
@@ -0,0 +1,7 @@
+# RDLENGTH = 4 bytes
+ 00 04
+# DNSKEY, flags 257
+ 01 01
+# protocol 3, algorithm 5
+ 03 05
+# no keydata