Check that buffer length in dns_message_renderbegin

The maximum DNS message size is 65535 octets. Check that the buffer
being passed to dns_message_renderbegin does not exceed this as the
compression code assumes that all offsets are no bigger than this.

(cherry picked from commit a06951323496ee084b49e01d436616adf2d67f1b)

diff --git a/lib/dns/include/dns/message.h b/lib/dns/include/dns/message.h
index b5d9a5a1681b8482a09f35cf7c67799b6a360abf..940c9b1748313ea0ab93a67dee824d4f6be2225e 100644 (file)
--- a/lib/dns/include/dns/message.h
+++ b/lib/dns/include/dns/message.h
@@ -597,7 +597,7 @@ dns_message_renderbegin(dns_message_t *msg, dns_compress_t *cctx,
  *
  *\li  'cctx' be valid.
  *
- *\li  'buffer' is a valid buffer.
+ *\li  'buffer' is a valid buffer with length less than 65536.
  *
  * Side Effects:
  *

diff --git a/lib/dns/message.c b/lib/dns/message.c
index 1b983d91944cf015cacc4b84f573f476f2689e9a..761a8e1471414123cdc3f607706ceb117b9c55e7 100644 (file)
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -1774,6 +1774,7 @@ dns_message_renderbegin(dns_message_t *msg, dns_compress_t *cctx,
 
        REQUIRE(DNS_MESSAGE_VALID(msg));
        REQUIRE(buffer != NULL);
+       REQUIRE(isc_buffer_length(buffer) < 65536);
        REQUIRE(msg->buffer == NULL);
        REQUIRE(msg->from_to_wire == DNS_MESSAGE_INTENTRENDER);