From 333a9a91ef47f9f9bd226015df819a8aafed7a71 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@amutable.com>
Date: Thu, 26 Feb 2026 15:51:09 +0100
Subject: [PATCH] dns-rr: tighten rules on parsing RR keys from JSON

let's ensure the name is actually a valid DNS name.
---
 src/shared/dns-rr.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/shared/dns-rr.c b/src/shared/dns-rr.c
index 0fa730c13ba..58d26e3609b 100644
--- a/src/shared/dns-rr.c
+++ b/src/shared/dns-rr.c
@@ -2215,6 +2215,12 @@ int dns_resource_key_from_json(sd_json_variant *v, DnsResourceKey **ret) {
         if (r < 0)
                 return r;
 
+        r = dns_name_is_valid(p.name);
+        if (r < 0)
+                return r;
+        if (r == 0)
+                return -EBADMSG;
+
         key = dns_resource_key_new(p.class, p.type, p.name);
         if (!key)
                 return -ENOMEM;
-- 
2.47.3