From a098420c07891450264c942ab6c7609a9e21b64c Mon Sep 17 00:00:00 2001
From: Benjamin Fry <benjaminfry@me.com>
Date: Tue, 20 Apr 2021 11:32:37 -0700
Subject: [PATCH] Fix panic on bad length for SVCB record

---
 CHANGELOG.md                      |  5 +++++
 crates/proto/src/rr/rdata/svcb.rs | 13 +++++++++++--
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e672759eea..9d390bfd81 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -23,6 +23,11 @@ All notes should be prepended with the location of the change, e.g. `(proto)` or
 ### Fixed
 
 - (proto) Panic when name exceeds maximal domain name length during display #1447
+## 0.20.2
+
+### Fixed
+
+- (proto) Panic on bad length in SVCB for record length
 
 ## 0.20.1
 
diff --git a/crates/proto/src/rr/rdata/svcb.rs b/crates/proto/src/rr/rdata/svcb.rs
index 0dc1f3f4cb..8bdf96309e 100644
--- a/crates/proto/src/rr/rdata/svcb.rs
+++ b/crates/proto/src/rr/rdata/svcb.rs
@@ -1032,7 +1032,7 @@ pub fn read(decoder: &mut BinDecoder<'_>, rdata_length: Restrict<u16>) -> ProtoR
     let svc_priority = decoder.read_u16()?.unverified(/*any u16 is valid*/);
     let target_name = Name::read(decoder)?;
 
-    let mut remainder_len = rdata_length.map(|len| len as usize - (decoder.index() - start_index)).unverified(/*valid len*/);
+    let mut remainder_len = rdata_length.map(|len| len as usize).checked_sub(decoder.index() - start_index).map_err(|len| format!("Bad length for RDATA of SVCB: {}", len))?.unverified(/*valid len*/);
     let mut svc_params: Vec<(SvcParamKey, SvcParamValue)> = Vec::new();
 
     // must have at least 4 bytes left for the key and the length
@@ -1053,7 +1053,7 @@ pub fn read(decoder: &mut BinDecoder<'_>, rdata_length: Restrict<u16>) -> ProtoR
         }
 
         svc_params.push((key, value));
-        remainder_len = rdata_length.map(|len| len as usize - (decoder.index() - start_index)).unverified(/*valid len*/);
+        remainder_len = rdata_length.map(|len| len as usize).checked_sub(decoder.index() - start_index).map_err(|len| format!("Bad length for RDATA of SVCB: {}", len))?.unverified(/*valid len*/);
     }
 
     Ok(SVCB {
@@ -1211,4 +1211,13 @@ mod tests {
             ],
         ));
     }
+
+    #[test]
+    fn test_no_panic() {
+        const BUF: &[u8] = &[
+            255, 121, 0, 0, 0, 0, 40, 255, 255, 160, 160, 0, 0, 0, 64, 0, 1, 255, 158, 0, 0, 0, 8,
+            0, 0, 7, 7, 0, 0, 0, 0, 0, 0, 0,
+        ];
+        assert!(crate::op::Message::from_vec(&BUF).is_err());
+    }
 }