From: Mark Andrews <marka@isc.org>
Date: Sun, 9 Dec 2012 21:22:01 +0000 (+1100)
Subject: silence clang --analyzer warnin by checking rdata.length
X-Git-Tag: v9.10.0a1~662
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=463f4ad70bed35fdc48d5afd312f1e098af34a29;p=thirdparty%2Fbind9.git

silence clang --analyzer warnin by checking rdata.length
---

diff --git a/lib/dns/nsec3.c b/lib/dns/nsec3.c
index 4975bf318aa..b63e11787fd 100644
--- a/lib/dns/nsec3.c
+++ b/lib/dns/nsec3.c
@@ -1098,7 +1098,12 @@ dns_nsec3param_deletechains(dns_db_t *db, dns_dbversion_t *ver,
 		INSIST(rdata.length <= sizeof(buf));
 		memcpy(buf, rdata.data, rdata.length);
 
-		if (buf[0] != 0 || (buf[2] & DNS_NSEC3FLAG_REMOVE) != 0 ||
+		/*
+		 * Private NSEC3 record length >= 6.
+		 * <0(1), hash(1), flags(1), iterations(2), saltlen(1)>
+		 */
+		if (rdata.length < 6 || buf[0] != 0 ||
+		    (buf[2] & DNS_NSEC3FLAG_REMOVE) != 0 ||
 		    (nonsec && (buf[2] & DNS_NSEC3FLAG_NONSEC) != 0))
 			continue;