diff --git a/CHANGES b/CHANGES
index d9852e1dd2..04bb7d7718 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,8 @@
 	--- 9.7.0a2 released ---
 
+2642.	[bug]		nsupdate could dump core on solaris when reading
+			improperly formatted key files.  [RT #20015]
+
 2641.	[bug]		Fixed an error in parsing update-policy syntax,
 			added a regression test to check it. [RT #20007]
 
diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
index 31b0880673..00221e0552 100644
--- a/lib/dns/dst_api.c
+++ b/lib/dns/dst_api.c
@@ -31,7 +31,7 @@
 
 /*
  * Principal Author: Brian Wellington
- * $Id: dst_api.c,v 1.24 2009/07/19 23:47:55 tbox Exp $
+ * $Id: dst_api.c,v 1.25 2009/07/29 23:45:24 each Exp $
  */
 
 /*! \file */
@@ -1052,6 +1052,9 @@ dst_key_read_public(const char *filename, int type,
 	/* Read the next word: either TTL, class, or 'KEY' */
 	NEXTTOKEN(lex, opt, &token);
 
+	if (token.type != isc_tokentype_string)
+		BADTOKEN();
+
 	/* If it's a TTL, read the next one */
 	result = dns_ttl_fromtext(&token.value.as_textregion, &ttl);
 	if (result == ISC_R_SUCCESS)