From 456e1eadd2a3a2fb9617e60d4db90ef4ba7c6ba3 Mon Sep 17 00:00:00 2001
From: Mukund Sivaraman <muks@isc.org>
Date: Mon, 22 Feb 2016 12:22:43 +0530
Subject: [PATCH] Fix resolver assertion failure due to improper DNAME handling
 (CVE-2016-1286) (#41753)

(cherry picked from commit 5995fec51cc8bb7e53804e4936e60aa1537f3673)

Hand applied Changelog changes.

CVE: CVE-2016-1286
Upstream-Status: Backport

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
---
diff -ruN a/CHANGES b/CHANGES
--- a/CHANGES	2016-04-11 09:46:42.075057394 +0200
+++ b/CHANGES	2016-04-11 09:44:21.857148819 +0200
@@ -1,3 +1,7 @@
+4319.  [security]      Fix resolver assertion failure due to improper
+                       DNAME handling when parsing fetch reply messages.
+                       (CVE-2016-1286) [RT #41753]
+
 4318.  [security]      Malformed control messages can trigger assertions
                        in named and rndc. (CVE-2016-1285) [RT #41666]
 
diff -ruN a/lib/dns/resolver.c b/lib/dns/resolver.c
--- a/lib/dns/resolver.c	2016-04-11 09:36:08.550578585 +0200
+++ b/lib/dns/resolver.c	2016-04-11 09:43:23.091701714 +0200
@@ -6634,21 +6634,26 @@
 				isc_boolean_t found_dname = ISC_FALSE;
 				dns_name_t *dname_name;
 
+				/*
+				 * Only pass DNAME or RRSIG(DNAME).
+				 */
+				if (rdataset->type != dns_rdatatype_dname &&
+				    (rdataset->type != dns_rdatatype_rrsig ||
+				     rdataset->covers != dns_rdatatype_dname))
+					continue;
+
+				/*
+				 * If we're not chaining, then the DNAME and
+				 * its signature should not be external.
+				 */
+				if (!chaining && external) {
+					log_formerr(fctx, "external DNAME");
+					return (DNS_R_FORMERR);
+				}
+
 				found = ISC_FALSE;
 				aflag = 0;
 				if (rdataset->type == dns_rdatatype_dname) {
-					/*
-					 * We're looking for something else,
-					 * but we found a DNAME.
-					 *
-					 * If we're not chaining, then the
-					 * DNAME should not be external.
-					 */
-					if (!chaining && external) {
-						log_formerr(fctx,
-							    "external DNAME");
-						return (DNS_R_FORMERR);
-					}
 					found = ISC_TRUE;
 					want_chaining = ISC_TRUE;
 					POST(want_chaining);
@@ -6677,9 +6682,7 @@
 							&fctx->domain)) {
 						return (DNS_R_SERVFAIL);
 					}
-				} else if (rdataset->type == dns_rdatatype_rrsig
-					   && rdataset->covers ==
-					   dns_rdatatype_dname) {
+				} else {
 					/*
 					 * We've found a signature that
 					 * covers the DNAME.