2640. [security] A specially crafted update packet will cause named

                        to exit. [RT #20000]

diff --git a/CHANGES b/CHANGES
index 674f88c6fc18afc0a2b9a413313c7c3c0075ded7..65ae7de68266124b0032f4e62ae50d802095c898 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,5 @@
-2639.  [bug]           Silence compiler warnings in gssapi code. [RT #19954]
+2640.  [security]      A specially crafted update packet will cause named
+                       to exit. [RT #20000]
 
 2637.  [func]          Rationalize dnssec-signzone's signwithkey() calling.
                        [RT #19959]

diff --git a/bin/named/update.c b/bin/named/update.c
index 1ff8f0c9e69d6177c3b8a6a490a84b6cfe05bde7..0004e1662ad3d213e1ef1ca7203d5afe12b8ef80 100644 (file)
--- a/bin/named/update.c
+++ b/bin/named/update.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: update.c,v 1.151.12.6 2009/06/22 03:29:20 marka Exp $ */
+/* $Id: update.c,v 1.151.12.7 2009/07/28 15:51:31 marka Exp $ */
 
 #include <config.h>
 
@@ -979,7 +979,11 @@ temp_check(isc_mem_t *mctx, dns_diff_t *temp, dns_db_t *db,
                        if (type == dns_rdatatype_rrsig ||
                            type == dns_rdatatype_sig)
                                covers = dns_rdata_covers(&t->rdata);
-                       else
+                       else if (type == dns_rdatatype_any) {
+                               dns_db_detachnode(db, &node);
+                               dns_diff_clear(&trash);
+                               return (DNS_R_NXRRSET);
+                       } else
                                covers = 0;
 
                        /*