diff --git a/CHANGES b/CHANGES index 9545d7e4a3..7818ade44e 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,7 @@ +5815. [bug] If an oversized key name of a specific length was used + in the text form of an HTTP or SVBC record, an INSIST + could be triggered when parsing it. [GL #3175] + 5814. [bug] The RecursClients statistics counter could underflow in certain resolution scenarios. [GL #3147] diff --git a/fuzz/dns_rdata_fromtext.in/svbc-max-token b/fuzz/dns_rdata_fromtext.in/svbc-max-token new file mode 100644 index 0000000000..6d1a265d9f --- /dev/null +++ b/fuzz/dns_rdata_fromtext.in/svbc-max-token @@ -0,0 +1 @@ +1 65 8 . aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa= diff --git a/lib/isc/lex.c b/lib/isc/lex.c index 9546553800..aa9b549f79 100644 --- a/lib/isc/lex.c +++ b/lib/isc/lex.c @@ -670,6 +670,13 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) { case lexstate_string: if (!escaped && c == '=' && (options & ISC_LEXOPT_VPAIR) != 0) { + if (remaining == 0U) { + result = grow_data(lex, &remaining, + &curr, &prev); + if (result != ISC_R_SUCCESS) { + goto done; + } + } INSIST(remaining > 0U); *curr++ = c; *curr = '\0'; @@ -682,7 +689,6 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) { if (state == lexstate_vpairstart) { if (c == '"' && (options & ISC_LEXOPT_QVPAIR) != 0) { - INSIST(remaining > 0U); no_comments = true; state = lexstate_qvpair; break;