This patch was derived from a source code patch provided by ISC to

resolve ISC ticket RT #43139. [9.6-ESV-R11-S8]

diff --git a/CHANGES b/CHANGES

index a439041..5b9e552 100644

--- a/CHANGES

+++ b/CHANGES

@@ -1,3 +1,8 @@

+	--- 9.6-ESV-R11-S8 released ---

+

+4467.	[security]	It was possible to trigger a assertion when rendering

+			a message. (CVE-2016-2776) [RT #43139]

+

 	--- 9.6-ESV-R11-S7 released ---

 4406.	[bug]		getrrsetbyname with a non absolute name could

diff --git a/lib/dns/api b/lib/dns/api

index 1320b72..9505559 100644

--- a/lib/dns/api

+++ b/lib/dns/api

@@ -5,5 +5,5 @@

 # 9.9: 90-109

 # 9.9-sub: 130-139

 LIBINTERFACE = 114

-LIBREVISION = 2

+LIBREVISION = 3

 LIBAGE = 1

diff --git a/lib/dns/message.c b/lib/dns/message.c

index 550058b..869d258 100644

--- a/lib/dns/message.c

+++ b/lib/dns/message.c

@@ -1734,7 +1734,7 @@ dns_message_renderbegin(dns_message_t *msg, dns_compress_t *cctx,

 	if (r.length < DNS_MESSAGE_HEADERLEN)

 		return (ISC_R_NOSPACE);

-	if (r.length < msg->reserved)

+	if (r.length - DNS_MESSAGE_HEADERLEN < msg->reserved)

 		return (ISC_R_NOSPACE);

 	/*

@@ -1833,6 +1833,27 @@ norender_rdataset(const dns_rdataset_t *rdataset, unsigned int options,

 	return (ISC_TRUE);

 }

+static isc_result_t

+renderset(dns_rdataset_t *rdataset, dns_name_t *owner_name,

+	  dns_compress_t *cctx, isc_buffer_t *target,

+	  unsigned int reserved, unsigned int options, unsigned int *countp)

+{

+	isc_result_t result;

+

+	/*

+	 * Shrink the space in the buffer by the reserved amount.

+	 */

+	if (target->length - target->used < reserved)

+		return (ISC_R_NOSPACE);

+

+	target->length -= reserved;

+	result = dns_rdataset_towire(rdataset, owner_name,

+				     cctx, target, options, countp);

+	target->length += reserved;

+

+	return (result);

+}

+

 isc_result_t

 dns_message_rendersection(dns_message_t *msg, dns_section_t sectionid,

 			  unsigned int options)

@@ -1875,6 +1896,8 @@ dns_message_rendersection(dns_message_t *msg, dns_section_t sectionid,

 	/*

 	 * Shrink the space in the buffer by the reserved amount.

 	 */

+	if (msg->buffer->length - msg->buffer->used < msg->reserved)

+		return (ISC_R_NOSPACE);

 	msg->buffer->length -= msg->reserved;

 	total = 0;

@@ -2134,9 +2157,8 @@ dns_message_renderend(dns_message_t *msg) {

 		 * Render.

 		 */

 		count = 0;

-		result = dns_rdataset_towire(msg->opt, dns_rootname,

-					     msg->cctx, msg->buffer, 0,

-					     &count);

+		result = renderset(msg->opt, dns_rootname, msg->cctx,

+				   msg->buffer, msg->reserved, 0, &count);

 		msg->counts[DNS_SECTION_ADDITIONAL] += count;

 		if (result != ISC_R_SUCCESS)

 			return (result);

@@ -2152,9 +2174,8 @@ dns_message_renderend(dns_message_t *msg) {

 		if (result != ISC_R_SUCCESS)

 			return (result);

 		count = 0;

-		result = dns_rdataset_towire(msg->tsig, msg->tsigname,

-					     msg->cctx, msg->buffer, 0,

-					     &count);

+		result = renderset(msg->tsig, msg->tsigname, msg->cctx,

+				   msg->buffer, msg->reserved, 0, &count);

 		msg->counts[DNS_SECTION_ADDITIONAL] += count;

 		if (result != ISC_R_SUCCESS)

 			return (result);

@@ -2175,9 +2196,8 @@ dns_message_renderend(dns_message_t *msg) {

 		 * the owner name of a SIG(0) is irrelevant, and will not

 		 * be set in a message being rendered.

 		 */

-		result = dns_rdataset_towire(msg->sig0, dns_rootname,

-					     msg->cctx, msg->buffer, 0,

-					     &count);

+		result = renderset(msg->sig0, dns_rootname, msg->cctx,

+				   msg->buffer, msg->reserved, 0, &count);

 		msg->counts[DNS_SECTION_ADDITIONAL] += count;

 		if (result != ISC_R_SUCCESS)

 			return (result);

diff --git a/version b/version

index fdf9b10..1aebb0c 100644

--- a/version

+++ b/version

@@ -9,5 +9,5 @@ MAJORVER=9

 MINORVER=6

 PATCHVER=

 RELEASETYPE=-ESV

 RELEASEVER=-R11

-EXTENSIONS=-S7

+EXTENSIONS=-S8