Reject too long ECDSA public keys

opensslecdsa_fromdns() already rejects too short ECDSA public keys.
Make it also reject too long ones.  Remove an assignment made redundant
by this change.

diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c
index 284f05e4e074a8f2a747ae90f482a59529bb769e..75411c5b68b699739855f51e506f52bdd34cadcb 100644 (file)
--- a/lib/dns/opensslecdsa_link.c
+++ b/lib/dns/opensslecdsa_link.c
@@ -752,7 +752,7 @@ opensslecdsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
        if (r.length == 0) {
                DST_RET(ISC_R_SUCCESS);
        }
-       if (r.length < len) {
+       if (r.length != len) {
                DST_RET(DST_R_INVALIDPUBLICKEY);
        }
 
@@ -788,7 +788,6 @@ opensslecdsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
                DST_RET(dst__openssl_toresult(ISC_R_FAILURE));
        }
 #else
-       len = r.length;
        ret = raw_key_to_ossl(key->key_alg, 0, r.base, len, &pkey);
        if (ret != ISC_R_SUCCESS) {
                DST_RET(ret);