From: Otto Moerbeek <otto.moerbeek@open-xchange.com>
Date: Mon, 4 May 2026 12:11:04 +0000 (+0200)
Subject: rec: check RRSIG record is valid in zonemd before processing further (#YWH-PGM6095... 
X-Git-Tag: rec-5.3.8~1
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c922fe79086cf4c9759f850b5b4e900b90ae73ca;p=thirdparty%2Fpdns.git

rec: check RRSIG record is valid in zonemd before processing further (#YWH-PGM6095-275)

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>
---

diff --git a/pdns/zonemd.cc b/pdns/zonemd.cc
index 92a10cfde3..0c97aaed51 100644
--- a/pdns/zonemd.cc
+++ b/pdns/zonemd.cc
@@ -232,6 +232,9 @@ void pdns::ZoneMD::verify(bool& validationDone, bool& validationOK)
     for (auto& resourceRecord : rrset.second) {
       if (qtype == QType::RRSIG) {
         const auto rrsig = std::dynamic_pointer_cast<const RRSIGRecordContent>(resourceRecord);
+        if (rrsig == nullptr) {
+          continue;
+        }
         if (rrsig->d_type == QType::ZONEMD && qname == DNSName(d_zone)) {
           continue;
         }
@@ -254,7 +257,10 @@ void pdns::ZoneMD::verify(bool& validationDone, bool& validationOK)
       // RRSIG is special, since  original TTL depends on qtype covered by RRSIG
       // which can be different per record
       for (const auto& rrsig : sorted) {
-        auto rrsigc = std::dynamic_pointer_cast<const RRSIGRecordContent>(rrsig);
+        const auto rrsigc = std::dynamic_pointer_cast<const RRSIGRecordContent>(rrsig);
+        if (rrsigc == nullptr) {
+          continue;
+        }
         RRSIGRecordContent rrc;
         rrc.d_originalttl = d_resourceRecordSetTTLs[pair(rrset.first.first, rrsigc->d_type)];
         rrc.d_type = qtype;