tag 1.6.4rc2

git-svn-id: file:///svn/unbound/tags/release-1.6.4rc2@4243 be551aaa-1e26-0410-a405-d3ace91eadb9

contrib/README

@@ -33,3 +33,4 @@ distribution but may be helpful.
   in /usr/lib/systemd/system.  Contributed by Sami Kerola and Pavel Odintsov.
 * redirect-bogus.patch: Return configured address for bogus A and AAAA answers,
   instead of SERVFAIL. Contributed by SIDN.
+* fastrpz.patch: fastrpz support from Farsight Security.

daemon/remote.c

@@ -263,7 +263,7 @@ daemon_remote_create(struct config_file* cfg)
 #if defined(SHA256_DIGEST_LENGTH) && defined(USE_ECDSA)
 	/* if we have sha256, set the cipher list to have no known vulns */
 	if(!SSL_CTX_set_cipher_list(rc->ctx, "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256"))
-		log_crypto_err("coult not set cipher list with SSL_CTX_set_cipher_list");
+		log_crypto_err("could not set cipher list with SSL_CTX_set_cipher_list");
 #endif
 
 	if (cfg->remote_control_use_cert == 0) {

doc/Changelog

@@ -1,6 +1,16 @@
+22 June 2017: Wouter
+	- Tag 1.6.4rc2
+
+22 June 2017: Ralph
+	- Added fastrpz patch to contrib
+
+21 June 2017: Wouter
+	- Fix #1316: heap read buffer overflow in parse_edns_options.
+
 20 June 2017: Wouter
 	- Fix warning in pythonmod under clang compiler.
 	- Tag 1.6.4rc1
+	- Fix lintian typo.
 
 16 June 2017: Ralph
 	- Fix #1277: disable domain ratelimit by setting value to 0.

util/data/msgparse.c

@@ -1018,7 +1018,7 @@ parse_extract_edns(struct msg_parse* msg, struct edns_data* edns,
 	edns->opt_list = NULL;
 
 	/* take the options */
-	rdata_len = found->rr_first->size;
+	rdata_len = found->rr_first->size-2;
 	rdata_ptr = found->rr_first->ttl_data+6;
 	if(!parse_edns_options(rdata_ptr, rdata_len, edns, region))
 		return 0;