This patch was derived from a source code patch provided by ISC to

resolve ISC ticket RT #43548. [9.6-ESV-R11-S10]

--- old/./CHANGES	Wed Jan 11 23:22:41 2017

+++ new/./CHANGES	Wed Jan 11 23:22:41 2017

@@ -1,5 +1,10 @@

 	--- 9.6-ESV-R11-S10 released ---

+4510.	[security]	Named mishandled some responses where covering RRSIG

+			records are returned without the requested data

+			resulting in a assertion failure. (CVE-2016-9147)

+			[RT #43548]

+

 4508.	[security]	Named incorrectly tried to cache TKEY records which

 			could trigger a assertion failure when there was

 			a class mismatch. (CVE-2016-9131) [RT #43522]

--- old/lib/dns/resolver.c	Wed Jan 11 23:22:41 2017

+++ new/lib/dns/resolver.c	Wed Jan 11 23:22:41 2017

@@ -5958,15 +5958,19 @@

 						 * a CNAME or DNAME).

 						 */

 						INSIST(!external);

-						if ((rdataset->type !=

-						     dns_rdatatype_cname) ||

-						    !found_dname ||

-						    (aflag ==

-						     DNS_RDATASETATTR_ANSWER))

+						/*

+						 * Don't use found_cname here

+						 * as we have just set it

+						 * above.

+						 */

+						if (cname == NULL &&

+						    !found_dname &&

+						    aflag ==

+						     DNS_RDATASETATTR_ANSWER)

 						{

 							have_answer = ISC_TRUE;

-							if (rdataset->type ==

-							    dns_rdatatype_cname)

+							if (found_cname &&

+							    cname == NULL)

 								cname = name;

 							name->attributes |=

 							    DNS_NAMEATTR_ANSWER;