mirror of
https://github.com/NLnetLabs/unbound.git
synced 2026-10-20 07:11:29 +02:00
Armaan SandhuandGitHub
aa7634afeb
nsec_at_apex() starts at the TTL, so the rdata ends at pos + 6 + rdatalen (4 bytes TTL, 2 bytes rdlength), but both bounds checks use pos + 4 + rdatalen. An NSEC whose type bitmap is 3 or 4 bytes long is then treated as malformed and not flagged as being at the apex, even when the SOA bit is set. Use the correct end of the rdata.