From: Mark Andrews <marka@isc.org>
Date: Thu, 19 Aug 2021 01:09:45 +0000 (+1000)
Subject: Reject zero length ALPN elements in fromwire
X-Git-Tag: v9.17.18~28^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8833d90292a9057c85f1d428a2f3418509cf6abb;p=thirdparty%2Fbind9.git

Reject zero length ALPN elements in fromwire
---

diff --git a/lib/dns/rdata/in_1/svcb_64.c b/lib/dns/rdata/in_1/svcb_64.c
index 8fbb99c7b7b..e1cf27c1b76 100644
--- a/lib/dns/rdata/in_1/svcb_64.c
+++ b/lib/dns/rdata/in_1/svcb_64.c
@@ -121,7 +121,7 @@ svcb_validate(uint16_t key, isc_region_t *region) {
 				}
 				while (region->length != 0) {
 					size_t l = *region->base + 1;
-					if (l > region->length) {
+					if (l == 1U || l > region->length) {
 						return (DNS_R_FORMERR);
 					}
 					isc_region_consume(region, l);
diff --git a/lib/dns/tests/rdata_test.c b/lib/dns/tests/rdata_test.c
index 595fcf9dac6..d64ffce789f 100644
--- a/lib/dns/tests/rdata_test.c
+++ b/lib/dns/tests/rdata_test.c
@@ -2723,6 +2723,11 @@ https_svcb(void **state) {
 		 * no-default-alpn (0x00 0x02) without alpn, alpn is required.
 		 */
 		WIRE_INVALID(0x00, 0x00, 0x01, 0x00, 0x00, 0x02, 0x00, 0x00),
+		/*
+		 * Alpn(0x00 0x01) with zero length elements is invalid
+		 */
+		WIRE_INVALID(0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x05,
+			     0x00, 0x00, 0x00, 0x00, 0x00),
 		WIRE_SENTINEL()
 	};
 	/* Test vectors from RFCXXXX */