enforce DS hash exists

(cherry picked from commit b274f3fad77d7325650ee3d1e4fd7f94b92edebe)

diff --git a/lib/dns/rdata/generic/ds_43.c b/lib/dns/rdata/generic/ds_43.c
index a03798f32747080c2c48fa66cd9d9218509ecb27..bf0628a8efa00bba8d1ba9c8984bfccfea937d97 100644 (file)
--- a/lib/dns/rdata/generic/ds_43.c
+++ b/lib/dns/rdata/generic/ds_43.c
@@ -174,7 +174,7 @@ generic_fromwire_ds(ARGS_FROMWIRE) {
        /*
         * Check digest lengths if we know them.
         */
-       if (sr.length < 4 ||
+       if (sr.length < 5 ||
            (sr.base[3] == DNS_DSDIGEST_SHA1 &&
             sr.length < 4 + ISC_SHA1_DIGESTLENGTH) ||
            (sr.base[3] == DNS_DSDIGEST_SHA256 &&