Blame SOURCES/bind99-CVE-2016-9131.patch
|
 |
900526 |
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
|
|
|
900526 |
index 2bc4461..d9de369 100644
|
|
|
900526 |
--- a/lib/dns/resolver.c
|
|
|
900526 |
+++ b/lib/dns/resolver.c
|
|
|
900526 |
@@ -6533,6 +6533,19 @@ answer_response(fetchctx_t *fctx) {
|
|
|
900526 |
log_formerr(fctx, "NSEC3 in answer");
|
|
|
900526 |
return (DNS_R_FORMERR);
|
|
|
900526 |
}
|
|
|
900526 |
+ if (rdataset->type == dns_rdatatype_tkey) {
|
|
|
900526 |
+ /*
|
|
|
900526 |
+ * TKEY is not a valid record in a
|
|
|
900526 |
+ * response to any query we can make.
|
|
|
900526 |
+ */
|
|
|
900526 |
+ log_formerr(fctx, "TKEY in answer");
|
|
|
900526 |
+ return (DNS_R_FORMERR);
|
|
|
900526 |
+ }
|
|
|
900526 |
+ if (rdataset->rdclass != fctx->res->rdclass) {
|
|
|
900526 |
+ log_formerr(fctx, "Mismatched class "
|
|
|
900526 |
+ "in answer");
|
|
|
900526 |
+ return (DNS_R_FORMERR);
|
|
|
900526 |
+ }
|
|
|
900526 |
|
|
|
900526 |
/*
|
|
|
900526 |
* Apply filters, if given, on answers to reject
|
|
|
900526 |
@@ -6719,6 +6732,12 @@ answer_response(fetchctx_t *fctx) {
|
|
|
900526 |
rdataset != NULL;
|
|
|
900526 |
rdataset = ISC_LIST_NEXT(rdataset, link))
|
|
|
900526 |
{
|
|
|
900526 |
+ if (rdataset->rdclass != fctx->res->rdclass) {
|
|
|
900526 |
+ log_formerr(fctx, "Mismatched class "
|
|
|
900526 |
+ "in answer");
|
|
|
900526 |
+ return (DNS_R_FORMERR);
|
|
|
900526 |
+ }
|
|
|
900526 |
+
|
|
|
900526 |
/*
|
|
|
900526 |
* Only pass DNAME or RRSIG(DNAME).
|
|
|
900526 |
*/
|