From: Mark Andrews <marka@isc.org>
Date: Tue, 7 Apr 2026 14:39:57 +0000 (+0200)
Subject: Fix assertion failure in dns_db_findrdataset() for SIG records
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=62920a981f4c8ee57b63f01e804755c07b4c5bd5;p=thirdparty%2Fbind9.git

Fix assertion failure in dns_db_findrdataset() for SIG records

dns__db_findrdataset() had a REQUIRE() that only accepted
dns_rdatatype_rrsig when the covers parameter was set.  A dynamic
update containing a SIG record (type 24) would trigger this
assertion, crashing named.  Use dns_rdatatype_issig() to accept
both SIG and RRSIG.

(cherry picked from commit 03edeccaa16991e05c101ae82a03568ae1b2dbd0)
---

diff --git a/lib/dns/db.c b/lib/dns/db.c
index eb771bee41e..3e92b1540f4 100644
--- a/lib/dns/db.c
+++ b/lib/dns/db.c
@@ -703,7 +703,8 @@ dns__db_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	REQUIRE(node != NULL);
 	REQUIRE(DNS_RDATASET_VALID(rdataset));
 	REQUIRE(!dns_rdataset_isassociated(rdataset));
-	REQUIRE(covers == 0 || type == dns_rdatatype_rrsig);
+	REQUIRE(covers == dns_rdatatype_none || type == dns_rdatatype_rrsig ||
+		type == dns_rdatatype_sig);
 	REQUIRE(type != dns_rdatatype_any);
 	REQUIRE(sigrdataset == NULL ||
 		(DNS_RDATASET_VALID(sigrdataset) &&