From: JINMEI Tatuya <jinmei@isc.org>
Date: Wed, 15 Feb 2012 17:12:05 +0000 (-0800)
Subject: [1638] in parseNSEC3ParamText(), checked the encoded salt length first to
X-Git-Tag: trac2351_base~247^2~9^2~1
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d3877a19035f09caa0b457cbe01fe28edacdeddd;p=thirdparty%2Fkea.git

[1638] in parseNSEC3ParamText(), checked the encoded salt length first to
reject too large salt sooner.
---

diff --git a/src/lib/dns/rdata/generic/detail/nsec3param_common.cc b/src/lib/dns/rdata/generic/detail/nsec3param_common.cc
index 178162119f..a7a0bb4b92 100644
--- a/src/lib/dns/rdata/generic/detail/nsec3param_common.cc
+++ b/src/lib/dns/rdata/generic/detail/nsec3param_common.cc
@@ -74,13 +74,16 @@ parseNSEC3ParamText(const char* const rrtype_name,
             iterations);
     }
 
+    // Salt is up to 255 bytes, and space is not allowed in the HEX encoding,
+    // so the encoded string cannot be longer than the double of max length
+    // of the actual salt.
+    if (salthex.size() > 255 * 2) {
+        isc_throw(InvalidRdataText, rrtype_name << " salt is too long: "
+                  << salthex.size() << " (encoded) bytes");
+    }
     if (salthex != "-") {       // "-" means a 0-length salt
         decodeHex(salthex, salt);
     }
-    if (salt.size() > 255) {
-        isc_throw(InvalidRdataText, rrtype_name << " salt is too long: "
-                  << salt.size() << " bytes");
-    }
 
     return (ParseNSEC3ParamResult(hashalg, flags, iterations));
 }