Index: CHANGES
===================================================================
RCS file: /proj/cvs/isc/bind8/src/CHANGES,v
retrieving revision 8.798.2.71.2.3
diff -u -r8.798.2.71.2.3 CHANGES
--- CHANGES	27 Jun 2002 04:19:29 -0000	8.798.2.71.2.3
+++ CHANGES	30 Oct 2002 11:24:54 -0000
@@ -1,9 +1,34 @@
+1469.	[bug]		buffer length calculation for PX was wrong.
+
+1468.	[bug]		ns_name_ntol() could overwite a zero length buffer.
+
+1467.	[bug]		off by one bug in ns_makecannon().
+
+1466.	[bug]		large ENDS UDP buffer size could trigger a assertion.
+
+1465.	[bug]		possible NULL pointer dereference in db_sec.c
+
+1464.	[bug]      	the buffer used to construct the -ve record was not
+			big enough for all possible SOA records.  use pointer
+			arithmetic to calculate the remaining size in this
+			buffer.
+
+1463.	[bug]		use serial space arithmetic to determine if a SIG is
+			too old, in the future or has internally constistant
+			times.
+
+1462.	[bug]		write buffer overflow in make_rr().
+
+1345.	[port]		64k answer buffers were causing stack space to be
+			exceeded for certian OS.  Use heap space instead.
+
+1300.	[bug]		read buffer overflows.
 
 	--- 8.2.6-REL released --- (Wed Jun 26 21:15:43 PDT 2002)
 
-1301.	[func]		log attempts to exploit #1300.
+1406.	[func]		log attempts to exploit #1405.
 
-1300.   [bug]           Remote buffer overrun.
+1405.   [bug]           Remote buffer overrun.
 
 	--- 8.2.5-REL released --- (Thu Sep 27 23:41:08 PDT 2001)
 
Index: bin/named/db_defs.h
===================================================================
RCS file: /proj/cvs/isc/bind8/src/bin/named/db_defs.h,v
retrieving revision 8.41
diff -u -r8.41 db_defs.h
--- bin/named/db_defs.h	8 Feb 2001 02:05:50 -0000	8.41
+++ bin/named/db_defs.h	30 Oct 2002 11:24:56 -0000
@@ -78,7 +78,7 @@
  */
 
 	/* max length of data in RR data field */
-#define MAXDATA		(2*MAXDNAME + 5*INT32SZ)
+#define MAXDATA		(3*MAXDNAME + 5*INT32SZ)
 
 	/* max length of data in a TXT RR segment */
 #define MAXCHARSTRING 255
Index: bin/named/db_sec.c
===================================================================
RCS file: /proj/cvs/isc/bind8/src/bin/named/db_sec.c,v
retrieving revision 8.32
diff -u -r8.32 db_sec.c
--- bin/named/db_sec.c	23 Dec 2000 08:14:36 -0000	8.32
+++ bin/named/db_sec.c	30 Oct 2002 11:25:00 -0000
@@ -479,7 +479,9 @@
 	struct sig_record *sigdata;
 	struct dnode *sigdn;
 	struct databuf *sigdp;
-	time_t now;
+	u_int32_t now;
+	u_int32_t exptime;
+	u_int32_t signtime;
 	char *signer;
 	u_char name_n[MAXDNAME];
 	u_char *sig, *eom;
@@ -492,6 +494,7 @@
 	int dnssec_failed = 0, dnssec_succeeded = 0;
 	int return_value;
 	int i;
+	int expired = 0;
 
 	if (rrset == NULL || rrset->rr_name == NULL) {
 		ns_warning (ns_log_default, "verify_set: missing rrset/name");
@@ -527,11 +530,14 @@
 		 * Don't verify a set if the SIG inception time is in
 		 * the future.  This should be fixed before 2038 (BEW)
 		 */
-		if (ntohl(sigdata->sig_time_n) > now)
+		signtime = ntohl(sigdata->sig_time_n);
+		if (SEQ_GT(signtime, now))
 			continue;
 
 		/* An expired set is dropped, but the data is not. */
-		if (ntohl(sigdata->sig_exp_n) < now) {
+		exptime = ntohl(sigdata->sig_exp_n);
+		if (SEQ_GT(now, exptime)) {
+			expired++;
 			db_freedata(sigdp);
 			sigdn->dp = NULL;
 			continue;
@@ -723,7 +729,7 @@
 	}
 
 end:
-	if (dnssec_failed > 0)
+	if (dnssec_failed > 0 || expired > 0)
 		rrset_trim_sigs(rrset);
 	if (trustedkey == 0 && key != NULL)
 		dst_free_key(key);
Index: bin/named/ns_ncache.c
===================================================================
RCS file: /proj/cvs/isc/bind8/src/bin/named/ns_ncache.c,v
retrieving revision 8.27
diff -u -r8.27 ns_ncache.c
--- bin/named/ns_ncache.c	21 Apr 2000 06:54:09 -0000	8.27
+++ bin/named/ns_ncache.c	30 Oct 2002 11:25:05 -0000
@@ -66,7 +66,7 @@
 	u_int16_t atype;
 	u_char *sp, *cp1;
 	u_char data[MAXDATA];
-	size_t len = sizeof data;
+	u_char *eod = data + sizeof(data);
 #endif
 
 	nameserIncr(from.sin_addr, nssRcvdNXD);
@@ -186,7 +186,7 @@
 		rdatap = cp;
 
 		/* origin */
-		n = dn_expand(msg, msg + msglen, cp, (char*)data, len);
+		n = dn_expand(msg, msg + msglen, cp, (char*)data, eod - data);
 		if (n < 0) {
 			ns_debug(ns_log_ncache, 3,
 				 "ncache: origin form error");
@@ -195,9 +195,8 @@
 		cp += n;
 		n = strlen((char*)data) + 1;
 		cp1 = data + n;
-		len -= n;
 		/* mail */
-		n = dn_expand(msg, msg + msglen, cp, (char*)cp1, len);
+		n = dn_expand(msg, msg + msglen, cp, (char*)cp1, eod - cp1);
 		if (n < 0) {
 			ns_debug(ns_log_ncache, 3, "ncache: mail form error");
 			return;
@@ -205,20 +204,20 @@
 		cp += n;
 		n = strlen((char*)cp1) + 1;
 		cp1 += n;
-		len -= n;
 		n = 5 * INT32SZ;
+		if (n > (eod - cp1))	/* Can't happen. See MAXDATA. */
+			return;
 		BOUNDS_CHECK(cp, n);
 		memcpy(cp1, cp, n);
 		/* serial, refresh, retry, expire, min */
 		cp1 += n;
-		len -= n;
 		cp += n;
 		if (cp != rdatap + dlen) {
 			ns_debug(ns_log_ncache, 3, "ncache: form error");
 			return;
 		}
 		/* store the zone of the soa record */
-		n = dn_expand(msg, msg + msglen, sp, (char*)cp1, len);
+		n = dn_expand(msg, msg + msglen, sp, (char*)cp1, eod - cp1);
 		if (n < 0) {
 			ns_debug(ns_log_ncache, 3, "ncache: form error 2");
 			return;
Index: bin/named/ns_req.c
===================================================================
RCS file: /proj/cvs/isc/bind8/src/bin/named/ns_req.c,v
retrieving revision 8.138.2.5
diff -u -r8.138.2.5 ns_req.c
--- bin/named/ns_req.c	20 Aug 2001 07:18:07 -0000	8.138.2.5
+++ bin/named/ns_req.c	30 Oct 2002 11:25:13 -0000
@@ -1928,7 +1928,7 @@
 
 		/* first just copy over the type_covered, algorithm, */
 		/* labels, orig ttl, two timestamps, and the footprint */
-		if ((dp->d_size - 18) > buflen)
+		if (buflen < 18)
 			goto cleanup;  /* out of room! */
 		memcpy(cp, cp1, 18);
 		cp  += 18;
Index: bin/named/ns_resp.c
===================================================================
RCS file: /proj/cvs/isc/bind8/src/bin/named/ns_resp.c,v
retrieving revision 8.152.2.4.2.1
diff -u -r8.152.2.4.2.1 ns_resp.c
--- bin/named/ns_resp.c	27 Jun 2002 04:15:00 -0000	8.152.2.4.2.1
+++ bin/named/ns_resp.c	30 Oct 2002 11:25:26 -0000
@@ -1963,7 +1963,7 @@
 		 * to BOUNDS_CHECK() here.
 		 */
 		cp1 += (n = strlen((char *)cp1) + 1);
-		n1 = sizeof(data) - n;
+		n1 = sizeof(data) - n - INT16SZ;
 		n = dn_expand(msg, eom, cp, (char *)cp1, n1);
 		if (n < 0) {
 			hp->rcode = FORMERR;
@@ -2005,8 +2005,18 @@
 			ttl = origTTL;
 		}
 
+		/*
+		 * Check that expire and signature times are internally
+		 * consistant.
+		 */
+		if (!SEQ_GT(exptime, signtime) && exptime != signtime) {
+			ns_debug(ns_log_default, 3,
+			"ignoring SIG: signature expires before it was signed");
+			return ((cp - rrp) + dlen);
+		}
+
 		/* Don't let bogus signers "sign" in the future.  */
-		if (signtime > now) {
+		if (SEQ_GT(signtime, now)) {
 			ns_debug(ns_log_default, 3,
 			  "ignoring SIG: signature date %s is in the future",
 				 p_secstodate (signtime));
@@ -2014,7 +2024,7 @@
 		}
 		
 		/* Ignore received SIG RR's that are already expired.  */
-		if (exptime <= now) {
+		if (SEQ_GT(now, exptime)) {
 			ns_debug(ns_log_default, 3,
 				"ignoring SIG: expiration %s is in the past",
 				 p_secstodate (exptime));
Index: lib/irs/dns_nw.c
===================================================================
RCS file: /proj/cvs/isc/bind8/src/lib/irs/dns_nw.c,v
retrieving revision 1.19.6.1
diff -u -r1.19.6.1 dns_nw.c
--- lib/irs/dns_nw.c	27 Jun 2002 02:45:45 -0000	1.19.6.1
+++ lib/irs/dns_nw.c	30 Oct 2002 11:25:31 -0000
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: dns_nw.c,v 1.19.6.1 2002/06/27 02:45:45 marka Exp $";
+static const char rcsid[] = "$Id: dns_nw.c,v 1.23 2002/06/26 07:42:06 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /* Imports. */
@@ -56,11 +56,7 @@
 
 #define	MAXALIASES	35
 
-#if PACKETSZ > 1024
-#define	MAXPACKET	PACKETSZ
-#else
-#define	MAXPACKET	1024
-#endif
+#define	MAXPACKET	(64*1024)
 
 struct pvt {
 	struct nwent	net;
@@ -185,6 +181,7 @@
 
 static struct nwent *
 nw_next(struct irs_nw *this) {
+
 	return (NULL);
 }
 
@@ -238,22 +235,33 @@
 static struct nwent *
 get1101byname(struct irs_nw *this, const char *name) {
 	struct pvt *pvt = (struct pvt *)this->private;
-	u_char ansbuf[MAXPACKET];
+	u_char *ansbuf;
 	int anslen;
+	struct nwent *result;
 
-	anslen = res_nsearch(pvt->res, name, C_IN, T_PTR,
-			     ansbuf, sizeof ansbuf);
-	if (anslen < 0)
+	ansbuf = memget(MAXPACKET);
+	if (ansbuf == NULL) {
+		errno = ENOMEM;
+		RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
 		return (NULL);
-	return (get1101mask(this, get1101answer(this, ansbuf, anslen, by_name,
-						AF_INET, name, NULL, 0)));
+	}
+	anslen = res_nsearch(pvt->res, name, C_IN, T_PTR, ansbuf, MAXPACKET);
+	if (anslen < 0) {
+		memput(ansbuf, MAXPACKET);
+		return (NULL);
+	}
+	result = get1101mask(this, get1101answer(this, ansbuf, anslen, by_name,
+						 AF_INET, name, NULL, 0));
+	memput(ansbuf, MAXPACKET);
+	return (result);
 }
 
 static struct nwent *
 get1101byaddr(struct irs_nw *this, u_char *net, int len) {
 	struct pvt *pvt = (struct pvt *)this->private;
 	char qbuf[sizeof "255.255.255.255.in-addr.arpa"];
-	u_char ansbuf[MAXPACKET];
+	struct nwent *result;
+	u_char *ansbuf;
 	int anslen;
 
 	if (len < 1 || len > 32) {
@@ -263,12 +271,21 @@
 	}
 	if (make1101inaddr(net, len, qbuf, sizeof qbuf) < 0)
 		return (NULL);
-	anslen = res_nquery(pvt->res, qbuf, C_IN, T_PTR,
-			    ansbuf, sizeof ansbuf);
-	if (anslen < 0)
+	ansbuf = memget(MAXPACKET);
+	if (ansbuf == NULL) {
+		errno = ENOMEM;
+		RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
+		return (NULL);
+	}
+	anslen = res_nquery(pvt->res, qbuf, C_IN, T_PTR, ansbuf, MAXPACKET);
+	if (anslen < 0) {
+		memput(ansbuf, MAXPACKET);
 		return (NULL);
-	return (get1101mask(this, get1101answer(this, ansbuf, anslen, by_addr,
-						AF_INET, NULL, net, len)));
+	}
+	result = get1101mask(this, get1101answer(this, ansbuf, anslen, by_addr,
+						 AF_INET, NULL, net, len));
+	memput(ansbuf, MAXPACKET);
+	return (result);
 }
 
 static struct nwent *
@@ -424,7 +441,7 @@
 	struct pvt *pvt = (struct pvt *)this->private;
 	char qbuf[sizeof "255.255.255.255.in-addr.arpa"], owner[MAXDNAME];
 	int anslen, type, class, ancount, qdcount;
-	u_char ansbuf[MAXPACKET], *cp, *eom;
+	u_char *ansbuf, *cp, *eom;
 	HEADER *hp;
 
 	if (!nwent)
@@ -435,10 +452,18 @@
 		return (nwent);
 	}
 
+	ansbuf = memget(MAXPACKET);
+	if (ansbuf == NULL) {
+		errno = ENOMEM;
+		RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
+		return (NULL);
+	}
 	/* Query for the A RR that would hold this network's mask. */
-	anslen = res_nquery(pvt->res, qbuf, C_IN, T_A, ansbuf, sizeof ansbuf);
-	if (anslen < HFIXEDSZ)
+	anslen = res_nquery(pvt->res, qbuf, C_IN, T_A, ansbuf, MAXPACKET);
+	if (anslen < HFIXEDSZ) {
+		memput(ansbuf, MAXPACKET);
 		return (nwent);
+	}
 
 	/* Initialize, and parse header. */
 	hp = (HEADER *)ansbuf;
@@ -448,8 +473,10 @@
 	while (qdcount-- > 0) {
 		int n = dn_skipname(cp, eom);
 		cp += n + QFIXEDSZ;
-		if (n < 0 || cp > eom)
+		if (n < 0 || cp > eom) {
+			memput(ansbuf, MAXPACKET);
 			return (nwent);
+		}
 	}
 	ancount = ntohs(hp->ancount);
 
@@ -483,6 +510,7 @@
 		}
 		cp += n;		/* RDATA */
 	}
+	memput(ansbuf, MAXPACKET);
 	return (nwent);
 }
 
@@ -535,7 +563,7 @@
 
 	/* Make lower case. */
 	for (t = name; *t; t++)
-		if (isascii(*t) && isupper(*t))
+		if (isascii((unsigned char)*t) && isupper((unsigned char)*t))
 			*t = tolower(*t);
 
 	/* Remove trailing dots. */
Index: lib/nameser/ns_name.c
===================================================================
RCS file: /proj/cvs/isc/bind8/src/lib/nameser/ns_name.c,v
retrieving revision 8.15
diff -u -r8.15 ns_name.c
--- lib/nameser/ns_name.c	30 Mar 2000 22:53:46 -0000	8.15
+++ lib/nameser/ns_name.c	30 Oct 2002 11:25:33 -0000
@@ -257,6 +257,10 @@
 	dn = dst;
 	eom = dst + dstsiz;
 
+	if (dn >= eom) {
+		errno = EMSGSIZE;
+		return (-1);
+	}
 	while ((n = *cp++) != 0) {
 		if ((n & NS_CMPRSFLGS) != 0) {
 			/* Some kind of compression pointer. */
Index: lib/nameser/ns_samedomain.c
===================================================================
RCS file: /proj/cvs/isc/bind8/src/lib/nameser/ns_samedomain.c,v
retrieving revision 8.9
diff -u -r8.9 ns_samedomain.c
--- lib/nameser/ns_samedomain.c	15 Oct 1999 21:06:51 -0000	8.9
+++ lib/nameser/ns_samedomain.c	30 Oct 2002 11:25:34 -0000
@@ -166,7 +166,7 @@
 ns_makecanon(const char *src, char *dst, size_t dstsize) {
 	size_t n = strlen(src);
 
-	if (n + sizeof "." > dstsize) {
+	if (n + sizeof "." + 1 > dstsize) {
 		errno = EMSGSIZE;
 		return (-1);
 	}
