Check that sig0 name is the root.

diff --git a/lib/dns/message.c b/lib/dns/message.c
index e57dfd9c02e516301f3e5807c5918e05ae51008e..602edc7a1063bad35a4329f07d09e79f54713667 100644 (file)
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -1456,7 +1456,9 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
                        covers = dns_rdata_covers(rdata);
                        if (covers == 0) {
                                if (sectionid != DNS_SECTION_ADDITIONAL ||
-                                   count != msg->counts[sectionid] - 1) {
+                                   count != msg->counts[sectionid] - 1 ||
+                                   !dns_name_equal(name, dns_rootname))
+                               {
                                        DO_ERROR(DNS_R_BADSIG0);
                                } else {
                                        skip_name_search = true;