svn commit: r278973 - stable/8/contrib/bind9/lib/dns

[Xin LI]

Author: delphij
Date: Wed Feb 18 22:29:52 2015
New Revision: 278973
URL: https://svnweb.freebsd.org/changeset/base/278973

Log:
  Fix CVE-2015-1349.
  
  This is a direct commit to stable/8 because BIND is removed from HEAD.

Modified:
  stable/8/contrib/bind9/lib/dns/zone.c

Modified: stable/8/contrib/bind9/lib/dns/zone.c
==============================================================================
--- stable/8/contrib/bind9/lib/dns/zone.c	Wed Feb 18 22:20:19 2015	(r278972)
+++ stable/8/contrib/bind9/lib/dns/zone.c	Wed Feb 18 22:29:52 2015	(r278973)
@@ -7931,6 +7931,12 @@ keyfetch_done(isc_task_t *task, isc_even
 					     namebuf, tag);
 				trustkey = ISC_TRUE;
 			}
+		} else {
+			/*
+			 * No previously known key, and the key is not
+			 * secure, so skip it.
+			 */
+			continue;
 		}
 
 		/* Delete old version */
@@ -7979,7 +7985,7 @@ keyfetch_done(isc_task_t *task, isc_even
 			trust_key(zone, keyname, &dnskey, mctx);
 		}
 
-		if (!deletekey)
+		if (secure && !deletekey)
 			set_refreshkeytimer(zone, &keydata, now);
 	}