[src/trunk]: src/external/bsd/bind/dist Apply P4:

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/97baf0bdd2ad
branches:  trunk
changeset: 781955:97baf0bdd2ad
user:      christos <christos%NetBSD.org@localhost>
date:      Tue Oct 09 22:55:39 2012 +0000

description:
Apply P4:

3383.  [security]      A certain combination of records in the RBT could
                       cause named to hang while populating the additional
                       section of a response. [RT #31090]

diffstat:

 external/bsd/bind/dist/CHANGES           |   6 ++
 external/bsd/bind/dist/bin/named/query.c |  68 ++++++++++++++++----------------
 external/bsd/bind/dist/version           |   2 +-
 3 files changed, 41 insertions(+), 35 deletions(-)

diffs (132 lines):

diff -r 78167da8a71b -r 97baf0bdd2ad external/bsd/bind/dist/CHANGES
--- a/external/bsd/bind/dist/CHANGES    Tue Oct 09 21:59:19 2012 +0000
+++ b/external/bsd/bind/dist/CHANGES    Tue Oct 09 22:55:39 2012 +0000
@@ -1,3 +1,9 @@
+       --- 9.9.1-P4 released ---
+
+3383.  [security]      A certain combination of records in the RBT could
+                        cause named to hang while populating the additional
+                        section of a response. [RT #31090]
+
        --- 9.9.1-P3 released ---
 
 3364.  [security]      Named could die on specially crafted record.
diff -r 78167da8a71b -r 97baf0bdd2ad external/bsd/bind/dist/bin/named/query.c
--- a/external/bsd/bind/dist/bin/named/query.c  Tue Oct 09 21:59:19 2012 +0000
+++ b/external/bsd/bind/dist/bin/named/query.c  Tue Oct 09 22:55:39 2012 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: query.c,v 1.8 2012/06/05 00:39:03 christos Exp $       */
+/*     $NetBSD: query.c,v 1.9 2012/10/09 22:55:40 christos Exp $       */
 
 /*
  * Copyright (C) 2004-2012  Internet Systems Consortium, Inc. ("ISC")
@@ -1121,13 +1121,6 @@
                mname = NULL;
        }
 
-       /*
-        * If the dns_name_t we're looking up is already in the message,
-        * we don't want to trigger the caller's name replacement logic.
-        */
-       if (name == mname)
-               mname = NULL;
-
        if (mnamep != NULL)
                *mnamep = mname;
 
@@ -1332,6 +1325,7 @@
        if (dns_rdataset_isassociated(rdataset) &&
            !query_isduplicate(client, fname, type, &mname)) {
                if (mname != NULL) {
+                       INSIST(mname != fname);
                        query_releasename(client, &fname);
                        fname = mname;
                } else
@@ -1401,11 +1395,13 @@
 #endif
                        if (!query_isduplicate(client, fname,
                                               dns_rdatatype_a, &mname)) {
-                               if (mname != NULL) {
-                                       query_releasename(client, &fname);
-                                       fname = mname;
-                               } else
-                                       need_addname = ISC_TRUE;
+                               if (mname != fname) {
+                                       if (mname != NULL) {
+                                               query_releasename(client, &fname);
+                                               fname = mname;
+                                       } else
+                                               need_addname = ISC_TRUE;
+                               }
                                ISC_LIST_APPEND(fname->list, rdataset, link);
                                added_something = ISC_TRUE;
                                if (sigrdataset != NULL &&
@@ -1458,11 +1454,13 @@
 #endif
                        if (!query_isduplicate(client, fname,
                                               dns_rdatatype_aaaa, &mname)) {
-                               if (mname != NULL) {
-                                       query_releasename(client, &fname);
-                                       fname = mname;
-                               } else
-                                       need_addname = ISC_TRUE;
+                               if (mname != fname) {
+                                       if (mname != NULL) {
+                                               query_releasename(client, &fname);
+                                               fname = mname;
+                                       } else
+                                               need_addname = ISC_TRUE;
+                               }
                                ISC_LIST_APPEND(fname->list, rdataset, link);
                                added_something = ISC_TRUE;
                                if (sigrdataset != NULL &&
@@ -1993,22 +1991,24 @@
                    crdataset->type == dns_rdatatype_aaaa) {
                        if (!query_isduplicate(client, fname, crdataset->type,
                                               &mname)) {
-                               if (mname != NULL) {
-                                       /*
-                                        * A different type of this name is
-                                        * already stored in the additional
-                                        * section.  We'll reuse the name.
-                                        * Note that this should happen at most
-                                        * once.  Otherwise, fname->link could
-                                        * leak below.
-                                        */
-                                       INSIST(mname0 == NULL);
-
-                                       query_releasename(client, &fname);
-                                       fname = mname;
-                                       mname0 = mname;
-                               } else
-                                       need_addname = ISC_TRUE;
+                               if (mname != fname) {
+                                       if (mname != NULL) {
+                                               /*
+                                                * A different type of this name is
+                                                * already stored in the additional
+                                                * section.  We'll reuse the name.
+                                                * Note that this should happen at most
+                                                * once.  Otherwise, fname->link could
+                                                * leak below.
+                                                */
+                                               INSIST(mname0 == NULL);
+
+                                               query_releasename(client, &fname);
+                                               fname = mname;
+                                               mname0 = mname;
+                                       } else
+                                               need_addname = ISC_TRUE;
+                               }
                                ISC_LIST_UNLINK(cfname.list, crdataset, link);
                                ISC_LIST_APPEND(fname->list, crdataset, link);
                                added_something = ISC_TRUE;
diff -r 78167da8a71b -r 97baf0bdd2ad external/bsd/bind/dist/version
--- a/external/bsd/bind/dist/version    Tue Oct 09 21:59:19 2012 +0000
+++ b/external/bsd/bind/dist/version    Tue Oct 09 22:55:39 2012 +0000
@@ -7,4 +7,4 @@
 MINORVER=9
 PATCHVER=1
 RELEASETYPE=-P
-RELEASEVER=3
+RELEASEVER=4