RPZ: Don't diff keys out of bounds, found via Valgrind (#38559)

diff --git a/CHANGES b/CHANGES
index 3dd18b8cad318ccd6e74a3e5e86a407b7ed5a2e4..6f3e839055e476d8bace2dd2e83bc640f9a6f88e 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+4062.  [bug]           Fix an out-of-bounds read in RPZ code. If the
+                       read succeeded, it doesn't result in a bug
+                       during operation. If the read failed, named
+                       could segfault. [RT #38559]
+
 4061.  [bug]           Handle timeout in legacy system test. [RT #38573]
 
 4060.  [bug]           dns_rdata_freestruct could be called on a

diff --git a/lib/dns/rpz.c b/lib/dns/rpz.c
index 7e06daf086da732c5057e43a4027f451731a48a4..7a46148e968095581d60f3447569f7bed2adbcae 100644 (file)
--- a/lib/dns/rpz.c
+++ b/lib/dns/rpz.c
@@ -866,13 +866,14 @@ diff_keys(const dns_rpz_cidr_key_t *key1, dns_rpz_prefix_t prefix1,
        dns_rpz_prefix_t maxbit, bit;
        int i;
 
+       bit = 0;
        maxbit = ISC_MIN(prefix1, prefix2);
 
        /*
         * find the first differing words
         */
-       for (i = 0, bit = 0;
-            bit <= maxbit;
+       for (i = 0;
+            bit < maxbit;
             i++, bit += DNS_RPZ_CIDR_WORD_BITS) {
                delta = key1->w[i] ^ key2->w[i];
                if (delta != 0) {