Commit 9d72da69fa for bind

commit 9d72da69fa5c0bee01035851a8656b170ff74d71
Author: Aydın Mercan <aydin@isc.org>
Date:   Fri Sep 25 18:12:38 2026 +0300

    Allow PKCS#11 labels as long as a private key file field

    The label of a key generated through a key-store is the PKCS#11 URI
    followed by the escaped zone and policy names, the key type and a
    timestamp. With pin-source pointing at an absolute path it easily
    exceeds NAME_MAX, and dns_keystore_keygen() then fails with "ran out
    of space" before any key is created.

    Size the buffer by MAXFIELDSIZE instead. That is the limit of what
    dst__privstruct_parse() can read back from the Label field of a
    .private file, so a label that fits here is also a label that named
    can load again; anything larger must fail at generation time rather
    than produce a key file that cannot be read.

diff --git a/lib/dns/keystore.c b/lib/dns/keystore.c
index 6ef2c2696e..bb916f7617 100644
--- a/lib/dns/keystore.c
+++ b/lib/dns/keystore.c
@@ -26,6 +26,8 @@
 #include <dns/keystore.h>
 #include <dns/keyvalues.h>

+#include "dst_parse.h"
+
 void
 dns_keystore_create(isc_mem_t *mctx, const char *name, dns_keystore_t **kspp) {
 	dns_keystore_t *keystore;
@@ -197,8 +199,12 @@ dns_keystore_keygen(dns_keystore_t *keystore, const dns_name_t *origin,
 		 * and policy name through 'dns_name_tofilenametext()'. We
 		 * could create a new function to convert a name to PKCS#11
 		 * text, but this existing function will suffice.
+		 *
+		 * The label is written to the Label field of the private
+		 * key file, which dst__privstruct_parse() reads back into a
+		 * MAXFIELDSIZE buffer, so that is the most that fits.
 		 */
-		char label[NAME_MAX + 1];
+		char label[MAXFIELDSIZE];
 		isc_buffer_t buf;
 		isc_buffer_init(&buf, label, sizeof(label));
 		result = buildpkcs11label(uri, origin, policy, flags, &buf);