From: Mark Andrews <marka@isc.org>
Date: Fri, 10 Apr 2026 06:23:27 +0000 (+1000)
Subject: fix: usr: Fix zone verification of NSEC3 signed zones
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0633effb5be121c71b72973fc0e1c53ca81781bf;p=thirdparty%2Fbind9.git

fix: usr: Fix zone verification of NSEC3 signed zones

Previously, when computing the compressed bitmap during verification of an NSEC3-signed zone, an undersized buffer was used that resulted in an out-of-bounds write if there were too many active windows in the bitmap. This impacted mirror zones which are NSEC3-signed, `dnssec-signzone` and `dnssec-verifyzone`. This has been fixed.

Closes #5834

Merge branch '5834-fix-cbm-size' into 'main'

See merge request isc-projects/bind9!11804
---

0633effb5be121c71b72973fc0e1c53ca81781bf