[master] fix length check in OPENPGPKEY

4170.	[security]	An incorrect boundary check in the OPENPGPKEY
			rdatatype could trigger an assertion failure.
			[RT #40286]

diff --git a/CHANGES b/CHANGES
index 0febf12fd4510d888ea3aa6a045084de84a34217..b182db0706dd203ed0da196e5d30a5ad505b4ba1 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+4170.  [security]      An incorrect boundary check in the OPENPGPKEY
+                       rdatatype could trigger an assertion failure.
+                       [RT #40286]
+
 4169.  [test]          Added a 'wire_test -d' option to read input as
                        raw binary data, for use as a fuzzing harness.
                        [RT #40312]

diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
index 1f6ca5b8576d9f8bb2708ec5a6e1d83f756aaab1..7d7a62080e8ff6cff421976c417d50149b7866ef 100644 (file)
--- a/doc/arm/notes.xml
+++ b/doc/arm/notes.xml
@@ -38,6 +38,12 @@
   <sect2 id="relnotes_security">
     <title>Security Fixes</title>
     <itemizedlist>
+      <listitem>
+       <para>
+         An incorrect boundary check in the OPENPGPKEY rdatatype
+         could trigger an assertion failure. [RT #40286]
+       </para>
+      </listitem>
       <listitem>
        <para>
          A buffer accounting error could trigger an assertion failure

diff --git a/lib/dns/rdata.c b/lib/dns/rdata.c
index a91667d1c550d94126755f7f692371251cf82e48..034a5f22459ba75f6af5f300aa566c16de20045f 100644 (file)
--- a/lib/dns/rdata.c
+++ b/lib/dns/rdata.c
@@ -1268,7 +1268,7 @@ txt_fromwire(isc_buffer_t *source, isc_buffer_t *target) {
 
        isc_buffer_activeregion(source, &sregion);
        if (sregion.length == 0)
-               return(ISC_R_UNEXPECTEDEND);
+               return (ISC_R_UNEXPECTEDEND);
        n = *sregion.base + 1;
        if (n > sregion.length)
                return (ISC_R_UNEXPECTEDEND);

diff --git a/lib/dns/rdata/generic/openpgpkey_61.c b/lib/dns/rdata/generic/openpgpkey_61.c
index 684f37b6f7c5b9e8fc49748ab0c6f767f2091063..99342a250fd87894d215588a70f374fbaacc3709 100644 (file)
--- a/lib/dns/rdata/generic/openpgpkey_61.c
+++ b/lib/dns/rdata/generic/openpgpkey_61.c
@@ -81,6 +81,8 @@ fromwire_openpgpkey(ARGS_FROMWIRE) {
         * Keyring.
         */
        isc_buffer_activeregion(source, &sr);
+       if (sr.length < 1)
+               return (ISC_R_UNEXPECTEDEND);
        isc_buffer_forward(source, sr.length);
        return (mem_tobuffer(target, sr.base, sr.length));
 }