Commit bc64ff63b9 for bind

commit bc64ff63b94d8f2e3178c3321730415ce33a086a
Author: Evan Hunt <each@isc.org>
Date:   Mon Nov 2 19:35:16 2026 -0800

    Fix length-checking errors in DELEG fromtext/totext

    Corrected errors in which buffer length was counted
    incorrectly when characters were escaped with backslashes.

diff --git a/lib/dns/rdata.c b/lib/dns/rdata.c
index d4dc6d4493..a01e46d564 100644
--- a/lib/dns/rdata.c
+++ b/lib/dns/rdata.c
@@ -1713,7 +1713,7 @@ commatxt_fromtext(isc_textregion_t *source, bool comma, bool isname,
 		}
 		comma_escape = false;

-		if (nrem == (isname && c == '\\') ? 1 : 0) {
+		if (nrem <= ((isname && c == '\\') ? 1 : 0)) {
 			return (tregion.length <= 256U) ? ISC_R_NOSPACE
 							: DNS_R_SYNTAX;
 		}
diff --git a/lib/dns/rdata/in_1/deleg_61440.c b/lib/dns/rdata/in_1/deleg_61440.c
index ed47c9a454..d7b941ae45 100644
--- a/lib/dns/rdata/in_1/deleg_61440.c
+++ b/lib/dns/rdata/in_1/deleg_61440.c
@@ -582,11 +582,11 @@ generic_fromtext_in_deleg(ARGS_FROMTEXT) {
 static isc_result_t
 comma_name_totext(const dns_name_t *name, isc_buffer_t *target) {
 	char in[DNS_NAME_FORMATSIZE];
-	size_t len = isc_buffer_availablelength(target);

 	dns_name_format(name, in, sizeof(in));

 	for (char *sp = in; *sp != '\0'; sp++) {
+		size_t len = isc_buffer_availablelength(target);
 		if (*sp == ',') {
 			if (len < 3) {
 				return ISC_R_NOSPACE;
@@ -606,7 +606,7 @@ comma_name_totext(const dns_name_t *name, isc_buffer_t *target) {
 		len--;
 	}

-	if (len < 1) {
+	if (isc_buffer_availablelength(target) < 1) {
 		return ISC_R_NOSPACE;
 	}
 	isc_buffer_putuint8(target, '.');