9.9.3-P2

can lead to a remotely triggerable REQUIRE failure
                        (CVE-2013-4854). [RT #34238]

(cherry picked from commit fdb4ae8f6c)

CHANGES

@@ -1,3 +1,14 @@
+	--- 9.9.3-P2 released ---
+
+3621.	[security]	Incorrect bounds checking on private type 'keydata'
+			can lead to a remotely triggerable REQUIRE failure
+			(CVE-2013-4854). [RT #34238]
+
+	--- 9.9.3-P1 released ---
+
+3584.	[security]	Caching data from an incompletely signed zone could
+			trigger an assertion failure in resolver.c [RT #33690]
+
 	--- 9.9.3 released ---
 
 3568.	[cleanup]	Add a product description line to the version file,

lib/dns/rdata/generic/keydata_65533.c

@@ -194,7 +194,7 @@ fromwire_keydata(ARGS_FROMWIRE) {
 	UNUSED(options);
 
 	isc_buffer_activeregion(source, &sr);
-	if (sr.length < 4)
+	if (sr.length < 16)
 		return (ISC_R_UNEXPECTEDEND);
 
 	isc_buffer_forward(source, sr.length);

lib/dns/resolver.c

@@ -4395,7 +4395,7 @@ fctx_log(void *arg, int level, const char *fmt, ...) {
 
 static inline isc_result_t
 findnoqname(fetchctx_t *fctx, dns_name_t *name, dns_rdatatype_t type,
-	    dns_name_t **noqname)
+	    dns_name_t **noqnamep)
 {
 	dns_rdataset_t *nrdataset, *next, *sigrdataset;
 	dns_rdata_rrsig_t rrsig;
@@ -4408,10 +4408,12 @@ findnoqname(fetchctx_t *fctx, dns_name_t *name, dns_rdatatype_t type,
 	dns_fixedname_t fclosest;
 	dns_name_t *nearest;
 	dns_fixedname_t fnearest;
+	dns_rdatatype_t found = dns_rdatatype_none;
+	dns_name_t *noqname = NULL;
 
 	FCTXTRACE("findnoqname");
 
-	REQUIRE(noqname != NULL && *noqname == NULL);
+	REQUIRE(noqnamep != NULL && *noqnamep == NULL);
 
 	/*
 	 * Find the SIG for this rdataset, if we have it.
@@ -4480,8 +4482,10 @@ findnoqname(fetchctx_t *fctx, dns_name_t *name, dns_rdatatype_t type,
 							&data, NULL, fctx_log,
 							fctx)))
 			{
-				if (!exists)
-					*noqname = nsec;
+				if (!exists) {
+					noqname = nsec;
+					found = dns_rdatatype_nsec;
+				}
 			}
 
 			if (nrdataset->type == dns_rdatatype_nsec3 &&
@@ -4494,13 +4498,26 @@ findnoqname(fetchctx_t *fctx, dns_name_t *name, dns_rdatatype_t type,
 							 closest, nearest,
 							 fctx_log, fctx)))
 			{
-				if (!exists && setnearest)
-					*noqname = nsec;
+				if (!exists && setnearest) {
+					noqname = nsec;
+					found = dns_rdatatype_nsec3;
+				}
 			}
 		}
 	}
 	if (result == ISC_R_NOMORE)
 		result = ISC_R_SUCCESS;
+	if (noqname != NULL) {
+		for (sigrdataset = ISC_LIST_HEAD(noqname->list);
+		     sigrdataset != NULL;
+		     sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) {
+			if (sigrdataset->type == dns_rdatatype_rrsig &&
+			    sigrdataset->covers == found)
+				break;
+		}
+		if (sigrdataset != NULL)
+			*noqnamep = noqname;
+	}
 	return (result);
 }
 

version

@@ -8,5 +8,5 @@ DESCRIPTION="(Extended Support Version)"
 MAJORVER=9
 MINORVER=9
 PATCHVER=3
-RELEASETYPE=
-RELEASEVER=
+RELEASETYPE=-P
+RELEASEVER=2