From 89c363b555c764f476c24c6cf2986aa115e8b05f Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Tue, 7 Apr 2026 16:39:57 +0200 Subject: [PATCH] Fix assertion failure in dns_db_findrdataset() for SIG records dns__db_findrdataset() had a REQUIRE() that only accepted dns_rdatatype_rrsig when the covers parameter was set. A dynamic update containing a SIG record (type 24) would trigger this assertion, crashing named. Use dns_rdatatype_issig() to accept both SIG and RRSIG. (cherry picked from commit 03edeccaa16991e05c101ae82a03568ae1b2dbd0) --- lib/dns/db.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/dns/db.c b/lib/dns/db.c index 358ec710d8..7b575faaf2 100644 --- a/lib/dns/db.c +++ b/lib/dns/db.c @@ -668,7 +668,8 @@ dns_db_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, REQUIRE(node != NULL); REQUIRE(DNS_RDATASET_VALID(rdataset)); REQUIRE(!dns_rdataset_isassociated(rdataset)); - REQUIRE(covers == 0 || type == dns_rdatatype_rrsig); + REQUIRE(covers == dns_rdatatype_none || type == dns_rdatatype_rrsig || + type == dns_rdatatype_sig); REQUIRE(type != dns_rdatatype_any); REQUIRE(sigrdataset == NULL || (DNS_RDATASET_VALID(sigrdataset) &&