From: Mark Andrews <marka@isc.org>
Date: Wed, 15 Feb 2017 01:18:51 +0000 (+1100)
Subject: 4575.   [security]      Dns64 with break-dnssec yes; can result in a
X-Git-Tag: v9.12.0a1~445
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3bce12e4b6d37f570ffc7747b499f8b90e8521ac;p=thirdparty%2Fbind9.git

4575.   [security]      Dns64 with break-dnssec yes; can result in a
                        assertion failure. (CVE-2017-3136) [RT #44653]
---

diff --git a/CHANGES b/CHANGES
index 74036906b3e..324dd17fdd8 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4575.	[security]	Dns64 with break-dnssec yes; can result in a
+			assertion failure. (CVE-2017-3136) [RT #44653]
+
 4574.	[bug]		Dig leaked memory with multiple +subnet options.
 			[RT #44683]
 
diff --git a/bin/named/query.c b/bin/named/query.c
index 0cfdf9288fb..5fd52f2b29e 100644
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -6984,6 +6984,7 @@ query_respond(query_ctx_t *qctx) {
 
 	if (qctx->dns64) {
 		result = query_dns64(qctx);
+		qctx->noqname = NULL;
 		dns_rdataset_disassociate(qctx->rdataset);
 		dns_message_puttemprdataset(qctx->client->message,
 					    &qctx->rdataset);
@@ -7110,7 +7111,7 @@ query_dns64(query_ctx_t *qctx) {
 
 	result = isc_buffer_allocate(client->mctx, &buffer,
 				     view->dns64cnt * 16 *
-				      dns_rdataset_count(qctx->rdataset));
+				     dns_rdataset_count(qctx->rdataset));
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 	result = dns_message_gettemprdataset(client->message,