Apply by doing cd /usr/src/sbin/named/named patch -p0 < named.patch And then to rebuild and install make && make install Index: ns_req.c =================================================================== RCS file: /cvs/src/usr.sbin/named/named/ns_req.c,v retrieving revision 1.3 retrieving revision 1.4 diff -u -r1.3 -r1.4 --- ns_req.c 1997/05/07 22:43:29 1.3 +++ ns_req.c 1998/03/31 00:16:30 1.4 @@ -1,11 +1,11 @@ -/* $OpenBSD: ns_req.c,v 1.3 1997/05/07 22:43:29 millert Exp $ */ +/* $OpenBSD: ns_req.c,v 1.4 1998/03/31 00:16:30 deraadt Exp $ */ #if !defined(lint) && !defined(SABER) #if 0 static char sccsid[] = "@(#)ns_req.c 4.47 (Berkeley) 7/1/91"; static char rcsid[] = "$From: ns_req.c,v 8.27 1996/10/08 04:51:03 vixie Exp $"; #else -static char rcsid[] = "$OpenBSD: ns_req.c,v 1.3 1997/05/07 22:43:29 millert Exp $"; +static char rcsid[] = "$OpenBSD: ns_req.c,v 1.4 1998/03/31 00:16:30 deraadt Exp $"; #endif #endif /* not lint */ @@ -1015,7 +1015,7 @@ switch (type) { case T_A: #ifndef INVQ - if (!fake_iquery) + if (!fake_iquery || dlen != INT32SZ) return (Refuse); #endif #ifdef INVQ @@ -1029,7 +1029,10 @@ dprintf(1, (ddt, "req: IQuery class %d type %d\n", class, type)); fname = (char *)msg + HFIXEDSZ; - bcopy(fname, anbuf, alen = (char *)*cpp - fname); + alen = (char *)*cpp - fname; + if ((size_t)alen > sizeof anbuf) + return (Refuse); + bcopy(fname, anbuf, alen); data = anbuf + alen - dlen; *cpp = (u_char *)fname; *buflenp -= HFIXEDSZ;