This commit was generated by cvs2svn to compensate for changes in r106907,

which included commits to RCS files with non-trunk default branches.

6 files changed, 32 insertions, 17 deletions

diff --git a/contrib/bind/bin/named/db_defs.h b/contrib/bind/bin/named/db_defs.h
index 68869f0..af00bb1 100644
--- a/contrib/bind/bin/named/db_defs.h
+++ b/contrib/bind/bin/named/db_defs.h
@@ -78,7 +78,7 @@
  */
 
 	/* max length of data in RR data field */
-#define MAXDATA		(2*MAXDNAME + 5*INT32SZ)
+#define MAXDATA		(3*MAXDNAME + 5*INT32SZ)
 
 	/* max length of data in a TXT RR segment */
 #define MAXCHARSTRING 255
diff --git a/contrib/bind/bin/named/db_sec.c b/contrib/bind/bin/named/db_sec.c
index 2d3425d..0ce0d9f 100644
--- a/contrib/bind/bin/named/db_sec.c
+++ b/contrib/bind/bin/named/db_sec.c
@@ -479,7 +479,9 @@ verify_set(struct db_rrset *rrset) {
 	struct sig_record *sigdata;
 	struct dnode *sigdn;
 	struct databuf *sigdp;
-	time_t now;
+	u_int32_t now;
+	u_int32_t exptime;
+	u_int32_t signtime;
 	char *signer;
 	u_char name_n[MAXDNAME];
 	u_char *sig, *eom;
@@ -492,6 +494,7 @@ verify_set(struct db_rrset *rrset) {
 	int dnssec_failed = 0, dnssec_succeeded = 0;
 	int return_value;
 	int i;
+	int expired = 0;
 
 	if (rrset == NULL || rrset->rr_name == NULL) {
 		ns_warning (ns_log_default, "verify_set: missing rrset/name");
@@ -527,11 +530,14 @@ verify_set(struct db_rrset *rrset) {
 		 * Don't verify a set if the SIG inception time is in
 		 * the future.  This should be fixed before 2038 (BEW)
 		 */
-		if ((time_t)ntohl(sigdata->sig_time_n) > now)
+		signtime = ntohl(sigdata->sig_time_n);
+		if (SEQ_GT(signtime, now))
 			continue;
 
 		/* An expired set is dropped, but the data is not. */
-		if ((time_t)ntohl(sigdata->sig_exp_n) < now) {
+		exptime = ntohl(sigdata->sig_exp_n);
+		if (SEQ_GT(now, exptime)) {
+			expired++;
 			db_detach(&sigdn->dp);
 			sigdp = NULL;
 			continue;
@@ -723,7 +729,7 @@ verify_set(struct db_rrset *rrset) {
 	}
 
 end:
-	if (dnssec_failed > 0)
+	if (dnssec_failed > 0 || expired > 0)
 		rrset_trim_sigs(rrset);
 	if (trustedkey == 0 && key != NULL)
 		dst_free_key(key);
diff --git a/contrib/bind/bin/named/ns_defs.h b/contrib/bind/bin/named/ns_defs.h
index f8bb976..c99c152 100644
--- a/contrib/bind/bin/named/ns_defs.h
+++ b/contrib/bind/bin/named/ns_defs.h
@@ -469,7 +469,7 @@ struct qinfo {
 			q_cmsglen,	/* len of cname message */
 			q_cmsgsize;	/* allocated size of cname message */
 	int16_t		q_dfd;		/* UDP file descriptor */
-	int16_t		q_udpsize;	/* UDP message size */
+	u_int16_t	q_udpsize;	/* UDP message size */
 	int		q_distance;	/* distance this query is from the
 					 * original query that the server
 					 * received. */
diff --git a/contrib/bind/bin/named/ns_ncache.c b/contrib/bind/bin/named/ns_ncache.c
index 5667f36..9ca3499 100644
--- a/contrib/bind/bin/named/ns_ncache.c
+++ b/contrib/bind/bin/named/ns_ncache.c
@@ -66,7 +66,7 @@ cache_n_resp(u_char *msg, int msglen, struct sockaddr_in from,
 	u_int16_t atype;
 	u_char *sp, *cp1;
 	u_char data[MAXDATA];
-	size_t len = sizeof data;
+	u_char *eod = data + sizeof(data);
 #endif
 
 	nameserIncr(from.sin_addr, nssRcvdNXD);
@@ -186,7 +186,7 @@ cache_n_resp(u_char *msg, int msglen, struct sockaddr_in from,
 		rdatap = cp;
 
 		/* origin */
-		n = dn_expand(msg, msg + msglen, cp, (char*)data, len);
+		n = dn_expand(msg, msg + msglen, cp, (char*)data, eod - data);
 		if (n < 0) {
 			ns_debug(ns_log_ncache, 3,
 				 "ncache: origin form error");
@@ -195,9 +195,8 @@ cache_n_resp(u_char *msg, int msglen, struct sockaddr_in from,
 		cp += n;
 		n = strlen((char*)data) + 1;
 		cp1 = data + n;
-		len -= n;
 		/* mail */
-		n = dn_expand(msg, msg + msglen, cp, (char*)cp1, len);
+		n = dn_expand(msg, msg + msglen, cp, (char*)cp1, eod - cp1);
 		if (n < 0) {
 			ns_debug(ns_log_ncache, 3, "ncache: mail form error");
 			return;
@@ -205,20 +204,20 @@ cache_n_resp(u_char *msg, int msglen, struct sockaddr_in from,
 		cp += n;
 		n = strlen((char*)cp1) + 1;
 		cp1 += n;
-		len -= n;
 		n = 5 * INT32SZ;
+		if (n > (eod - cp1))	/* Can't happen. See MAXDATA. */
+			return;
 		BOUNDS_CHECK(cp, n);
 		memcpy(cp1, cp, n);
 		/* serial, refresh, retry, expire, min */
 		cp1 += n;
-		len -= n;
 		cp += n;
 		if (cp != rdatap + dlen) {
 			ns_debug(ns_log_ncache, 3, "ncache: form error");
 			return;
 		}
 		/* store the zone of the soa record */
-		n = dn_expand(msg, msg + msglen, sp, (char*)cp1, len);
+		n = dn_expand(msg, msg + msglen, sp, (char*)cp1, eod - cp1);
 		if (n < 0) {
 			ns_debug(ns_log_ncache, 3, "ncache: form error 2");
 			return;
diff --git a/contrib/bind/bin/named/ns_req.c b/contrib/bind/bin/named/ns_req.c
index 6aca04a..42039f9 100644
--- a/contrib/bind/bin/named/ns_req.c
+++ b/contrib/bind/bin/named/ns_req.c
@@ -2195,7 +2195,7 @@ make_rr(const char *name, struct databuf *dp, u_char *buf,
 
 		/* first just copy over the type_covered, algorithm, */
 		/* labels, orig ttl, two timestamps, and the footprint */
-		if ((dp->d_size - 18) > buflen)
+		if (buflen < 18)
 			goto cleanup;  /* out of room! */
 		memcpy(cp, cp1, 18);
 		cp  += 18;
diff --git a/contrib/bind/bin/named/ns_resp.c b/contrib/bind/bin/named/ns_resp.c
index 91a3869..c371fba 100644
--- a/contrib/bind/bin/named/ns_resp.c
+++ b/contrib/bind/bin/named/ns_resp.c
@@ -2001,7 +2001,7 @@ rrextract(u_char *msg, int msglen, u_char *rrp, struct databuf **dpp,
 		 * to BOUNDS_CHECK() here.
 		 */
 		cp1 += (n = strlen((char *)cp1) + 1);
-		n1 = sizeof(data) - n;
+		n1 = sizeof(data) - n - INT16SZ;
 		n = dn_expand(msg, eom, cp, (char *)cp1, n1);
 		if (n < 0) {
 			hp->rcode = FORMERR;
@@ -2043,8 +2043,18 @@ rrextract(u_char *msg, int msglen, u_char *rrp, struct databuf **dpp,
 			ttl = origTTL;
 		}
 
+		/*
+		 * Check that expire and signature times are internally
+		 * consistant.
+		 */
+		if (!SEQ_GT(exptime, signtime) && exptime != signtime) {
+			ns_debug(ns_log_default, 3,
+			"ignoring SIG: signature expires before it was signed");
+			return ((cp - rrp) + dlen);
+		}
+
 		/* Don't let bogus signers "sign" in the future.  */
-		if (signtime > now) {
+		if (SEQ_GT(signtime, now)) {
 			ns_debug(ns_log_default, 3,
 			  "ignoring SIG: signature date %s is in the future",
 				 p_secstodate (signtime));
@@ -2052,7 +2062,7 @@ rrextract(u_char *msg, int msglen, u_char *rrp, struct databuf **dpp,
 		}
 		
 		/* Ignore received SIG RR's that are already expired.  */
-		if (exptime <= now) {
+		if (SEQ_GT(now, exptime)) {
 			ns_debug(ns_log_default, 3,
 				"ignoring SIG: expiration %s is in the past",
 				 p_secstodate (exptime));