explicit DNAME query could trigger a crash if deny-answer-aliases was set

(cherry picked from commit a21c3810d3453548cc05ae19995125dabea9ca9c)
(cherry picked from commit 6e187b86562088147656ba22a9ed3bb74e1fe58c)

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 8f674a26d0331d5a10b356b105d4ff3faeee78ad..b897120e00fcceb8030396f20c0bce7c67fe2023 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -6318,6 +6318,7 @@ is_answertarget_allowed(fetchctx_t *fctx, dns_name_t *qname, dns_name_t *rname,
        unsigned int nlabels;
        dns_fixedname_t fixed;
        dns_name_t prefix;
+       int order;
 
        REQUIRE(rdataset != NULL);
        REQUIRE(rdataset->type == dns_rdatatype_cname ||
@@ -6340,17 +6341,24 @@ is_answertarget_allowed(fetchctx_t *fctx, dns_name_t *qname, dns_name_t *rname,
                tname = &cname.cname;
                break;
        case dns_rdatatype_dname:
+               if (dns_name_fullcompare(qname, rname, &order, &nlabels) !=
+                   dns_namereln_subdomain)
+               {
+                       return (ISC_TRUE);
+               }
                result = dns_rdata_tostruct(&rdata, &dname, NULL);
                RUNTIME_CHECK(result == ISC_R_SUCCESS);
                dns_name_init(&prefix, NULL);
                tname = dns_fixedname_initname(&fixed);
                nlabels = dns_name_countlabels(qname) -
                          dns_name_countlabels(rname);
+               INSIST(nlabels > 0);
                dns_name_split(qname, nlabels, &prefix, NULL);
                result = dns_name_concatenate(&prefix, &dname.dname, tname,
                                              NULL);
-               if (result == DNS_R_NAMETOOLONG)
+               if (result == DNS_R_NAMETOOLONG) {
                        return (ISC_TRUE);
+               }
                RUNTIME_CHECK(result == ISC_R_SUCCESS);
                break;
        default:
@@ -7071,7 +7079,9 @@ answer_response(fetchctx_t *fctx) {
                }
                if ((ardataset->type == dns_rdatatype_cname ||
                     ardataset->type == dns_rdatatype_dname) &&
-                    !is_answertarget_allowed(fctx, qname, aname, ardataset,
+                   type != ardataset->type &&
+                   type != dns_rdatatype_any &&
+                   !is_answertarget_allowed(fctx, qname, aname, ardataset,
                                              NULL))
                {
                        return (DNS_R_SERVFAIL);