3861. [security] Missing isc_buffer_availablelength check results

                        in a REQUIRE assertion when printing out a packet.
                        [RT #36078]

diff --git a/CHANGES b/CHANGES
index 6d2b6f11386c67097794c5ec45541a67ef71e63e..afd146a239e0f32eb7673ad701bbe8ca1e440963 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+3861.  [security]      Missing isc_buffer_availablelength check results
+                       in a REQUIRE assertion when printing out a packet.
+                       [RT #36078]
+
 3860.  [bug]           ioctl(DP_POLL) array size needs to be determined
                        at run time as it is limited to {OPEN_MAX}.
                        [RT #35878]

diff --git a/lib/dns/message.c b/lib/dns/message.c
index a062e951ba3e92e2db4f2771fc5f7e0588836d82..88c9239eb6d31886295ddbf3a5332cfbcb799a84 100644 (file)
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -3248,7 +3248,8 @@ dns_message_pseudosectiontotext(dns_message_t *msg,
                                dns_pseudosection_t section,
                                const dns_master_style_t *style,
                                dns_messagetextflag_t flags,
-                               isc_buffer_t *target) {
+                               isc_buffer_t *target)
+{
        dns_rdataset_t *ps = NULL;
        dns_name_t *name = NULL;
        isc_result_t result;
@@ -3369,6 +3370,8 @@ dns_message_pseudosectiontotext(dns_message_t *msg,
                                 * version
                                 */
                                ADD_STRING(target, "(\"");
+                               if (isc_buffer_availablelength(target) < optlen)
+                                       return (ISC_R_NOSPACE);
                                for (i = 0; i < optlen; i++) {
                                        if (isprint(optdata[i]))
                                                isc_buffer_putmem(target,