Upgrade to 9.6-ESV-R4-P1, which address the following issues:

1. Very large RRSIG RRsets included in a negative cache can trigger
an assertion failure that will crash named (BIND 9 DNS) due to an
off-by-one error in a buffer size check.

This bug affects all resolving name servers, whether DNSSEC validation
is enabled or not, on all BIND versions prior to today. There is a
possibility of malicious exploitation of this bug by remote users.

2. Named could fail to validate zones listed in a DLV that validated
insecure without using DLV and had DS records in the parent zone.

Add a patch provided by ru@ and confirmed by ISC to fix a crash at
shutdown time when a SIG(0) key is being used.

24 files changed, 24 insertions, 24 deletions

diff --git a/contrib/bind9/lib/dns/rdata/in_1/a6_38.c b/contrib/bind9/lib/dns/rdata/in_1/a6_38.c
index d4d42bb..450b74c 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/a6_38.c
+++ b/contrib/bind9/lib/dns/rdata/in_1/a6_38.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: a6_38.c,v 1.54 2007/06/19 23:47:17 tbox Exp $ */
+/* $Id: a6_38.c,v 1.54 2007-06-19 23:47:17 tbox Exp $ */
 
 /* RFC2874 */
 
diff --git a/contrib/bind9/lib/dns/rdata/in_1/a6_38.h b/contrib/bind9/lib/dns/rdata/in_1/a6_38.h
index 75e53f1..2fcb4b3 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/a6_38.h
+++ b/contrib/bind9/lib/dns/rdata/in_1/a6_38.h
@@ -18,7 +18,7 @@
 #ifndef IN_1_A6_38_H
 #define IN_1_A6_38_H 1
 
-/* $Id: a6_38.h,v 1.24 2007/06/19 23:47:17 tbox Exp $ */
+/* $Id: a6_38.h,v 1.24 2007-06-19 23:47:17 tbox Exp $ */
 
 /*! 
  *  \brief Per RFC2874 */
diff --git a/contrib/bind9/lib/dns/rdata/in_1/a_1.c b/contrib/bind9/lib/dns/rdata/in_1/a_1.c
index d7644bc..1181e44 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/a_1.c
+++ b/contrib/bind9/lib/dns/rdata/in_1/a_1.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: a_1.c,v 1.53 2007/06/19 23:47:17 tbox Exp $ */
+/* $Id: a_1.c,v 1.53 2007-06-19 23:47:17 tbox Exp $ */
 
 /* Reviewed: Thu Mar 16 16:52:50 PST 2000 by bwelling */
 
diff --git a/contrib/bind9/lib/dns/rdata/in_1/a_1.h b/contrib/bind9/lib/dns/rdata/in_1/a_1.h
index c192d1a..6d0fb35 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/a_1.h
+++ b/contrib/bind9/lib/dns/rdata/in_1/a_1.h
@@ -19,7 +19,7 @@
 #ifndef IN_1_A_1_H
 #define IN_1_A_1_H 1
 
-/* $Id: a_1.h,v 1.28 2007/06/19 23:47:17 tbox Exp $ */
+/* $Id: a_1.h,v 1.28 2007-06-19 23:47:17 tbox Exp $ */
 
 typedef struct dns_rdata_in_a {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/in_1/aaaa_28.c b/contrib/bind9/lib/dns/rdata/in_1/aaaa_28.c
index d0503a9..119131c 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/aaaa_28.c
+++ b/contrib/bind9/lib/dns/rdata/in_1/aaaa_28.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: aaaa_28.c,v 1.45 2007/06/19 23:47:17 tbox Exp $ */
+/* $Id: aaaa_28.c,v 1.45 2007-06-19 23:47:17 tbox Exp $ */
 
 /* Reviewed: Thu Mar 16 16:52:50 PST 2000 by bwelling */
 
diff --git a/contrib/bind9/lib/dns/rdata/in_1/aaaa_28.h b/contrib/bind9/lib/dns/rdata/in_1/aaaa_28.h
index 54a0cb3..76dd219 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/aaaa_28.h
+++ b/contrib/bind9/lib/dns/rdata/in_1/aaaa_28.h
@@ -18,7 +18,7 @@
 #ifndef IN_1_AAAA_28_H
 #define IN_1_AAAA_28_H 1
 
-/* $Id: aaaa_28.h,v 1.21 2007/06/19 23:47:17 tbox Exp $ */
+/* $Id: aaaa_28.h,v 1.21 2007-06-19 23:47:17 tbox Exp $ */
 
 /*! 
  *  \brief Per RFC1886 */
diff --git a/contrib/bind9/lib/dns/rdata/in_1/apl_42.c b/contrib/bind9/lib/dns/rdata/in_1/apl_42.c
index 28ca68e..70f6880 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/apl_42.c
+++ b/contrib/bind9/lib/dns/rdata/in_1/apl_42.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: apl_42.c,v 1.14 2008/01/22 23:28:04 tbox Exp $ */
+/* $Id: apl_42.c,v 1.14 2008-01-22 23:28:04 tbox Exp $ */
 
 /* RFC3123 */
 
diff --git a/contrib/bind9/lib/dns/rdata/in_1/apl_42.h b/contrib/bind9/lib/dns/rdata/in_1/apl_42.h
index 2d01040..049a28b 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/apl_42.h
+++ b/contrib/bind9/lib/dns/rdata/in_1/apl_42.h
@@ -19,7 +19,7 @@
 #ifndef IN_1_APL_42_H
 #define IN_1_APL_42_H 1
 
-/* $Id: apl_42.h,v 1.6 2007/06/19 23:47:17 tbox Exp $ */
+/* $Id: apl_42.h,v 1.6 2007-06-19 23:47:17 tbox Exp $ */
 
 typedef struct dns_rdata_apl_ent {
 	isc_boolean_t	negative;
diff --git a/contrib/bind9/lib/dns/rdata/in_1/dhcid_49.c b/contrib/bind9/lib/dns/rdata/in_1/dhcid_49.c
index 27c4e4e..5759a76d 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/dhcid_49.c
+++ b/contrib/bind9/lib/dns/rdata/in_1/dhcid_49.c
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dhcid_49.c,v 1.5 2007/06/19 23:47:17 tbox Exp $ */
+/* $Id: dhcid_49.c,v 1.5 2007-06-19 23:47:17 tbox Exp $ */
 
 /* RFC 4701 */
 
diff --git a/contrib/bind9/lib/dns/rdata/in_1/dhcid_49.h b/contrib/bind9/lib/dns/rdata/in_1/dhcid_49.h
index 2797192..c63cc7b 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/dhcid_49.h
+++ b/contrib/bind9/lib/dns/rdata/in_1/dhcid_49.h
@@ -18,7 +18,7 @@
 #ifndef IN_1_DHCID_49_H
 #define IN_1_DHCID_49_H 1
 
-/* $Id: dhcid_49.h,v 1.5 2007/06/19 23:47:17 tbox Exp $ */
+/* $Id: dhcid_49.h,v 1.5 2007-06-19 23:47:17 tbox Exp $ */
 
 typedef struct dns_rdata_in_dhcid {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/in_1/kx_36.c b/contrib/bind9/lib/dns/rdata/in_1/kx_36.c
index 9df2e5e..795844d 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/kx_36.c
+++ b/contrib/bind9/lib/dns/rdata/in_1/kx_36.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: kx_36.c,v 1.45 2007/06/19 23:47:17 tbox Exp $ */
+/* $Id: kx_36.c,v 1.45 2007-06-19 23:47:17 tbox Exp $ */
 
 /* Reviewed: Thu Mar 16 17:24:54 PST 2000 by explorer */
 
diff --git a/contrib/bind9/lib/dns/rdata/in_1/kx_36.h b/contrib/bind9/lib/dns/rdata/in_1/kx_36.h
index 391ae27..db58c15 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/kx_36.h
+++ b/contrib/bind9/lib/dns/rdata/in_1/kx_36.h
@@ -18,7 +18,7 @@
 #ifndef IN_1_KX_36_H
 #define IN_1_KX_36_H 1
 
-/* $Id: kx_36.h,v 1.20 2007/06/19 23:47:17 tbox Exp $ */
+/* $Id: kx_36.h,v 1.20 2007-06-19 23:47:17 tbox Exp $ */
 
 /*! 
  *  \brief Per RFC2230 */
diff --git a/contrib/bind9/lib/dns/rdata/in_1/naptr_35.c b/contrib/bind9/lib/dns/rdata/in_1/naptr_35.c
index 21ab44c..51aadf7 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/naptr_35.c
+++ b/contrib/bind9/lib/dns/rdata/in_1/naptr_35.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: naptr_35.c,v 1.53 2008/02/15 23:46:51 tbox Exp $ */
+/* $Id: naptr_35.c,v 1.53 2008-02-15 23:46:51 tbox Exp $ */
 
 /* Reviewed: Thu Mar 16 16:52:50 PST 2000 by bwelling */
 
diff --git a/contrib/bind9/lib/dns/rdata/in_1/naptr_35.h b/contrib/bind9/lib/dns/rdata/in_1/naptr_35.h
index 503f7a8..03acbdd 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/naptr_35.h
+++ b/contrib/bind9/lib/dns/rdata/in_1/naptr_35.h
@@ -18,7 +18,7 @@
 #ifndef IN_1_NAPTR_35_H
 #define IN_1_NAPTR_35_H 1
 
-/* $Id: naptr_35.h,v 1.23 2007/06/19 23:47:17 tbox Exp $ */
+/* $Id: naptr_35.h,v 1.23 2007-06-19 23:47:17 tbox Exp $ */
 
 /*! 
  *  \brief Per RFC2915 */
diff --git a/contrib/bind9/lib/dns/rdata/in_1/nsap-ptr_23.c b/contrib/bind9/lib/dns/rdata/in_1/nsap-ptr_23.c
index 2da7869..615d24a 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/nsap-ptr_23.c
+++ b/contrib/bind9/lib/dns/rdata/in_1/nsap-ptr_23.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nsap-ptr_23.c,v 1.38 2007/06/19 23:47:17 tbox Exp $ */
+/* $Id: nsap-ptr_23.c,v 1.38 2007-06-19 23:47:17 tbox Exp $ */
 
 /* Reviewed: Fri Mar 17 10:16:02 PST 2000 by gson */
 
diff --git a/contrib/bind9/lib/dns/rdata/in_1/nsap-ptr_23.h b/contrib/bind9/lib/dns/rdata/in_1/nsap-ptr_23.h
index 14a8b19..3becbd0 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/nsap-ptr_23.h
+++ b/contrib/bind9/lib/dns/rdata/in_1/nsap-ptr_23.h
@@ -18,7 +18,7 @@
 #ifndef IN_1_NSAP_PTR_23_H
 #define IN_1_NSAP_PTR_23_H 1
 
-/* $Id: nsap-ptr_23.h,v 1.19 2007/06/19 23:47:17 tbox Exp $ */
+/* $Id: nsap-ptr_23.h,v 1.19 2007-06-19 23:47:17 tbox Exp $ */
 
 /*! 
  *  \brief Per RFC1348.  Obsoleted in RFC 1706 - use PTR instead. */
diff --git a/contrib/bind9/lib/dns/rdata/in_1/nsap_22.c b/contrib/bind9/lib/dns/rdata/in_1/nsap_22.c
index c25f560..1aaf13f 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/nsap_22.c
+++ b/contrib/bind9/lib/dns/rdata/in_1/nsap_22.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nsap_22.c,v 1.42 2007/06/19 23:47:17 tbox Exp $ */
+/* $Id: nsap_22.c,v 1.42 2007-06-19 23:47:17 tbox Exp $ */
 
 /* Reviewed: Fri Mar 17 10:41:07 PST 2000 by gson */
 
diff --git a/contrib/bind9/lib/dns/rdata/in_1/nsap_22.h b/contrib/bind9/lib/dns/rdata/in_1/nsap_22.h
index 11e3f66..1742472 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/nsap_22.h
+++ b/contrib/bind9/lib/dns/rdata/in_1/nsap_22.h
@@ -18,7 +18,7 @@
 #ifndef IN_1_NSAP_22_H
 #define IN_1_NSAP_22_H 1
 
-/* $Id: nsap_22.h,v 1.18 2007/06/19 23:47:17 tbox Exp $ */
+/* $Id: nsap_22.h,v 1.18 2007-06-19 23:47:17 tbox Exp $ */
 
 /*! 
  *  \brief Per RFC1706 */
diff --git a/contrib/bind9/lib/dns/rdata/in_1/px_26.c b/contrib/bind9/lib/dns/rdata/in_1/px_26.c
index 1d17f2f..517b87c 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/px_26.c
+++ b/contrib/bind9/lib/dns/rdata/in_1/px_26.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: px_26.c,v 1.43 2007/06/19 23:47:17 tbox Exp $ */
+/* $Id: px_26.c,v 1.43 2007-06-19 23:47:17 tbox Exp $ */
 
 /* Reviewed: Mon Mar 20 10:44:27 PST 2000 */
 
diff --git a/contrib/bind9/lib/dns/rdata/in_1/px_26.h b/contrib/bind9/lib/dns/rdata/in_1/px_26.h
index 69a7bae..57285f4 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/px_26.h
+++ b/contrib/bind9/lib/dns/rdata/in_1/px_26.h
@@ -18,7 +18,7 @@
 #ifndef IN_1_PX_26_H
 #define IN_1_PX_26_H 1
 
-/* $Id: px_26.h,v 1.19 2007/06/19 23:47:17 tbox Exp $ */
+/* $Id: px_26.h,v 1.19 2007-06-19 23:47:17 tbox Exp $ */
 
 /*! 
  *  \brief Per RFC2163 */
diff --git a/contrib/bind9/lib/dns/rdata/in_1/srv_33.c b/contrib/bind9/lib/dns/rdata/in_1/srv_33.c
index 7bc85cd..ac9e577 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/srv_33.c
+++ b/contrib/bind9/lib/dns/rdata/in_1/srv_33.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: srv_33.c,v 1.45 2007/06/19 23:47:17 tbox Exp $ */
+/* $Id: srv_33.c,v 1.45 2007-06-19 23:47:17 tbox Exp $ */
 
 /* Reviewed: Fri Mar 17 13:01:00 PST 2000 by bwelling */
 
diff --git a/contrib/bind9/lib/dns/rdata/in_1/srv_33.h b/contrib/bind9/lib/dns/rdata/in_1/srv_33.h
index e019698..b7c2a13 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/srv_33.h
+++ b/contrib/bind9/lib/dns/rdata/in_1/srv_33.h
@@ -18,7 +18,7 @@
 #ifndef IN_1_SRV_33_H
 #define IN_1_SRV_33_H 1
 
-/* $Id: srv_33.h,v 1.19 2007/06/19 23:47:17 tbox Exp $ */
+/* $Id: srv_33.h,v 1.19 2007-06-19 23:47:17 tbox Exp $ */
 
 /* Reviewed: Fri Mar 17 13:01:00 PST 2000 by bwelling */
 
diff --git a/contrib/bind9/lib/dns/rdata/in_1/wks_11.c b/contrib/bind9/lib/dns/rdata/in_1/wks_11.c
index 55859c4..b7d5057 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/wks_11.c
+++ b/contrib/bind9/lib/dns/rdata/in_1/wks_11.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: wks_11.c,v 1.54.332.2 2009/02/16 23:47:15 tbox Exp $ */
+/* $Id: wks_11.c,v 1.54.332.2 2009-02-16 23:47:15 tbox Exp $ */
 
 /* Reviewed: Fri Mar 17 15:01:49 PST 2000 by explorer */
 
diff --git a/contrib/bind9/lib/dns/rdata/in_1/wks_11.h b/contrib/bind9/lib/dns/rdata/in_1/wks_11.h
index 2fd26e8..9ef250a 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/wks_11.h
+++ b/contrib/bind9/lib/dns/rdata/in_1/wks_11.h
@@ -18,7 +18,7 @@
 #ifndef IN_1_WKS_11_H
 #define IN_1_WKS_11_H 1
 
-/* $Id: wks_11.h,v 1.22 2007/06/19 23:47:17 tbox Exp $ */
+/* $Id: wks_11.h,v 1.22 2007-06-19 23:47:17 tbox Exp $ */
 
 typedef	struct dns_rdata_in_wks {
 	dns_rdatacommon_t	common;