Index: bind-9.6-ESV-R11-W1/lib/dns/hmac_link.c
===================================================================
--- bind-9.6-ESV-R11-W1.orig/lib/dns/hmac_link.c	2014-02-11 00:40:00.000000000 +0100
+++ bind-9.6-ESV-R11-W1/lib/dns/hmac_link.c	2015-09-02 11:15:01.436654569 +0200
@@ -237,6 +237,8 @@
 	key->key_size = keylen * 8;
 	key->keydata.hmacmd5 = hkey;
 
+	isc_buffer_forward(data, r.length);
+
 	return (ISC_R_SUCCESS);
 }
 
@@ -505,6 +507,8 @@
 	key->key_size = keylen * 8;
 	key->keydata.hmacsha1 = hkey;
 
+	isc_buffer_forward(data, r.length);
+
 	return (ISC_R_SUCCESS);
 }
 
@@ -774,6 +778,8 @@
 	key->key_size = keylen * 8;
 	key->keydata.hmacsha224 = hkey;
 
+	isc_buffer_forward(data, r.length);
+
 	return (ISC_R_SUCCESS);
 }
 
@@ -1043,6 +1049,8 @@
 	key->key_size = keylen * 8;
 	key->keydata.hmacsha256 = hkey;
 
+	isc_buffer_forward(data, r.length);
+
 	return (ISC_R_SUCCESS);
 }
 
@@ -1312,6 +1320,8 @@
 	key->key_size = keylen * 8;
 	key->keydata.hmacsha384 = hkey;
 
+	isc_buffer_forward(data, r.length);
+
 	return (ISC_R_SUCCESS);
 }
 
@@ -1581,6 +1591,8 @@
 	key->key_size = keylen * 8;
 	key->keydata.hmacsha512 = hkey;
 
+	isc_buffer_forward(data, r.length);
+
 	return (ISC_R_SUCCESS);
 }
 
Index: bind-9.6-ESV-R11-W1/lib/dns/include/dst/dst.h
===================================================================
--- bind-9.6-ESV-R11-W1.orig/lib/dns/include/dst/dst.h	2014-02-11 00:40:00.000000000 +0100
+++ bind-9.6-ESV-R11-W1/lib/dns/include/dst/dst.h	2015-09-02 11:15:01.437654583 +0200
@@ -65,6 +65,7 @@
 #define DST_ALG_HMACSHA256	163	/* XXXMPA */
 #define DST_ALG_HMACSHA384	164	/* XXXMPA */
 #define DST_ALG_HMACSHA512	165	/* XXXMPA */
+#define DST_ALG_INDIRECT	252
 #define DST_ALG_PRIVATE		254
 #define DST_ALG_EXPAND		255
 #define DST_MAX_ALGS		255
Index: bind-9.6-ESV-R11-W1/lib/dns/ncache.c
===================================================================
--- bind-9.6-ESV-R11-W1.orig/lib/dns/ncache.c	2014-02-11 00:40:00.000000000 +0100
+++ bind-9.6-ESV-R11-W1/lib/dns/ncache.c	2015-09-02 11:15:01.437654583 +0200
@@ -665,13 +665,11 @@
 		dns_name_fromregion(&tname, &remaining);
 		INSIST(remaining.length >= tname.length);
 		isc_buffer_forward(&source, tname.length);
-		remaining.length -= tname.length;
-		remaining.base += tname.length;
+		isc_region_consume(&remaining, tname.length);
 
 		INSIST(remaining.length >= 2);
 		type = isc_buffer_getuint16(&source);
-		remaining.length -= 2;
-		remaining.base += 2;
+		isc_region_consume(&remaining, 2);
 
 		if (type != dns_rdatatype_rrsig ||
 		    !dns_name_equal(&tname, name)) {
@@ -683,8 +681,7 @@
 		INSIST(remaining.length >= 1);
 		trust = isc_buffer_getuint8(&source);
 		INSIST(trust <= dns_trust_ultimate);
-		remaining.length -= 1;
-		remaining.base += 1;
+		isc_region_consume(&remaining, 1);
 
 		raw = remaining.base;
 		count = raw[0] * 256 + raw[1];
Index: bind-9.6-ESV-R11-W1/lib/dns/openssldh_link.c
===================================================================
--- bind-9.6-ESV-R11-W1.orig/lib/dns/openssldh_link.c	2014-02-11 00:40:00.000000000 +0100
+++ bind-9.6-ESV-R11-W1/lib/dns/openssldh_link.c	2015-09-02 11:15:01.437654583 +0200
@@ -236,8 +236,10 @@
 
 static void
 uint16_toregion(isc_uint16_t val, isc_region_t *region) {
-	*region->base++ = (val & 0xff00) >> 8;
-	*region->base++ = (val & 0x00ff);
+	*region->base = (val & 0xff00) >> 8;
+	isc_region_consume(region, 1);
+	*region->base = (val & 0x00ff);
+	isc_region_consume(region, 1);
 }
 
 static isc_uint16_t
@@ -248,7 +250,8 @@
 	val = ((unsigned int)(cp[0])) << 8;
 	val |= ((unsigned int)(cp[1]));
 
-	region->base += 2;
+	isc_region_consume(region, 2);
+
 	return (val);
 }
 
@@ -289,16 +292,16 @@
 	}
 	else
 		BN_bn2bin(dh->p, r.base);
-	r.base += plen;
+	isc_region_consume(&r, plen);
 
 	uint16_toregion(glen, &r);
 	if (glen > 0)
 		BN_bn2bin(dh->g, r.base);
-	r.base += glen;
+	isc_region_consume(&r, glen);
 
 	uint16_toregion(publen, &r);
 	BN_bn2bin(dh->pub_key, r.base);
-	r.base += publen;
+	isc_region_consume(&r, publen);
 
 	isc_buffer_add(data, dnslen);
 
@@ -339,10 +342,12 @@
 		return (DST_R_INVALIDPUBLICKEY);
 	}
 	if (plen == 1 || plen == 2) {
-		if (plen == 1)
-			special = *r.base++;
-		else
+		if (plen == 1) {
+			special = *r.base;
+			isc_region_consume(&r, 1);
+		} else {
 			special = uint16_fromregion(&r);
+		}
 		switch (special) {
 			case 1:
 				dh->p = &bn768;
@@ -357,10 +362,9 @@
 				DH_free(dh);
 				return (DST_R_INVALIDPUBLICKEY);
 		}
-	}
-	else {
+	} else {
 		dh->p = BN_bin2bn(r.base, plen, NULL);
-		r.base += plen;
+		isc_region_consume(&r, plen);
 	}
 
 	/*
@@ -391,15 +395,14 @@
 				return (DST_R_INVALIDPUBLICKEY);
 			}
 		}
-	}
-	else {
+	} else {
 		if (glen == 0) {
 			DH_free(dh);
 			return (DST_R_INVALIDPUBLICKEY);
 		}
 		dh->g = BN_bin2bn(r.base, glen, NULL);
 	}
-	r.base += glen;
+	isc_region_consume(&r, glen);
 
 	if (r.length < 2) {
 		DH_free(dh);
@@ -411,7 +414,7 @@
 		return (DST_R_INVALIDPUBLICKEY);
 	}
 	dh->pub_key = BN_bin2bn(r.base, publen, NULL);
-	r.base += publen;
+	isc_region_consume(&r, publen);
 
 	key->key_size = BN_num_bits(dh->p);
 
Index: bind-9.6-ESV-R11-W1/lib/dns/openssldsa_link.c
===================================================================
--- bind-9.6-ESV-R11-W1.orig/lib/dns/openssldsa_link.c	2014-02-11 00:40:00.000000000 +0100
+++ bind-9.6-ESV-R11-W1/lib/dns/openssldsa_link.c	2015-09-02 11:15:01.438654596 +0200
@@ -29,8 +29,6 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id$ */
-
 #ifdef OPENSSL
 #ifndef USE_EVP
 #define USE_EVP 1
@@ -137,6 +135,7 @@
 	DSA *dsa = key->keydata.dsa;
 	isc_region_t r;
 	DSA_SIG *dsasig;
+	unsigned int klen;
 #if USE_EVP
 	EVP_MD_CTX *evp_md_ctx = dctx->ctxdata.evp_md_ctx;
 	EVP_PKEY *pkey;
@@ -188,6 +187,7 @@
 					       ISC_R_FAILURE));
 	}
 	free(sigbuf);
+
 #elif 0
 	/* Only use EVP for the Digest */
 	if (!EVP_DigestFinal_ex(evp_md_ctx, digest, &siglen)) {
@@ -209,11 +209,17 @@
 					       "DSA_do_sign",
 					       DST_R_SIGNFAILURE));
 #endif
-	*r.base++ = (key->key_size - 512)/64;
+
+	klen = (key->key_size - 512)/64;
+	if (klen > 255)
+		return (ISC_R_FAILURE);
+	*r.base = klen;
+	isc_region_consume(&r, 1);
+
 	BN_bn2bin_fixed(dsasig->r, r.base, ISC_SHA1_DIGESTLENGTH);
-	r.base += ISC_SHA1_DIGESTLENGTH;
+	isc_region_consume(&r, ISC_SHA1_DIGESTLENGTH);
 	BN_bn2bin_fixed(dsasig->s, r.base, ISC_SHA1_DIGESTLENGTH);
-	r.base += ISC_SHA1_DIGESTLENGTH;
+	isc_region_consume(&r, ISC_SHA1_DIGESTLENGTH);
 	DSA_SIG_free(dsasig);
 	isc_buffer_add(sig, ISC_SHA1_DIGESTLENGTH * 2 + 1);
 
@@ -416,15 +422,16 @@
 	if (r.length < (unsigned int) dnslen)
 		return (ISC_R_NOSPACE);
 
-	*r.base++ = t;
+	*r.base = t;
+	isc_region_consume(&r, 1);
 	BN_bn2bin_fixed(dsa->q, r.base, ISC_SHA1_DIGESTLENGTH);
-	r.base += ISC_SHA1_DIGESTLENGTH;
+	isc_region_consume(&r, ISC_SHA1_DIGESTLENGTH);
 	BN_bn2bin_fixed(dsa->p, r.base, key->key_size/8);
-	r.base += p_bytes;
+	isc_region_consume(&r, p_bytes);
 	BN_bn2bin_fixed(dsa->g, r.base, key->key_size/8);
-	r.base += p_bytes;
+	isc_region_consume(&r, p_bytes);
 	BN_bn2bin_fixed(dsa->pub_key, r.base, key->key_size/8);
-	r.base += p_bytes;
+	isc_region_consume(&r, p_bytes);
 
 	isc_buffer_add(data, dnslen);
 
@@ -449,29 +456,30 @@
 		return (ISC_R_NOMEMORY);
 	dsa->flags &= ~DSA_FLAG_CACHE_MONT_P;
 
-	t = (unsigned int) *r.base++;
+	t = (unsigned int) *r.base;
+	isc_region_consume(&r, 1);
 	if (t > 8) {
 		DSA_free(dsa);
 		return (DST_R_INVALIDPUBLICKEY);
 	}
 	p_bytes = 64 + 8 * t;
 
-	if (r.length < 1 + ISC_SHA1_DIGESTLENGTH + 3 * p_bytes) {
+	if (r.length < ISC_SHA1_DIGESTLENGTH + 3 * p_bytes) {
 		DSA_free(dsa);
 		return (DST_R_INVALIDPUBLICKEY);
 	}
 
 	dsa->q = BN_bin2bn(r.base, ISC_SHA1_DIGESTLENGTH, NULL);
-	r.base += ISC_SHA1_DIGESTLENGTH;
+	isc_region_consume(&r, ISC_SHA1_DIGESTLENGTH);
 
 	dsa->p = BN_bin2bn(r.base, p_bytes, NULL);
-	r.base += p_bytes;
+	isc_region_consume(&r, p_bytes);
 
 	dsa->g = BN_bin2bn(r.base, p_bytes, NULL);
-	r.base += p_bytes;
+	isc_region_consume(&r, p_bytes);
 
 	dsa->pub_key = BN_bin2bn(r.base, p_bytes, NULL);
-	r.base += p_bytes;
+	isc_region_consume(&r, p_bytes);
 
 	key->key_size = p_bytes * 8;
 
Index: bind-9.6-ESV-R11-W1/lib/dns/opensslrsa_link.c
===================================================================
--- bind-9.6-ESV-R11-W1.orig/lib/dns/opensslrsa_link.c	2014-02-11 00:40:00.000000000 +0100
+++ bind-9.6-ESV-R11-W1/lib/dns/opensslrsa_link.c	2015-09-02 11:15:01.438654596 +0200
@@ -908,6 +908,7 @@
 	RSA *rsa;
 	isc_region_t r;
 	unsigned int e_bytes;
+	unsigned int length;
 #if USE_EVP
 	EVP_PKEY *pkey;
 #endif
@@ -915,6 +916,7 @@
 	isc_buffer_remainingregion(data, &r);
 	if (r.length == 0)
 		return (ISC_R_SUCCESS);
+	length = r.length;
 
 	rsa = RSA_new();
 	if (rsa == NULL)
@@ -925,17 +927,18 @@
 		RSA_free(rsa);
 		return (DST_R_INVALIDPUBLICKEY);
 	}
-	e_bytes = *r.base++;
-	r.length--;
+	e_bytes = *r.base;
+	isc_region_consume(&r, 1);
 
 	if (e_bytes == 0) {
 		if (r.length < 2) {
 			RSA_free(rsa);
 			return (DST_R_INVALIDPUBLICKEY);
 		}
-		e_bytes = ((*r.base++) << 8);
-		e_bytes += *r.base++;
-		r.length -= 2;
+		e_bytes = (*r.base) << 8;
+		isc_region_consume(&r, 1);
+		e_bytes += *r.base;
+		isc_region_consume(&r, 1);
 	}
 
 	if (r.length < e_bytes) {
@@ -943,14 +946,13 @@
 		return (DST_R_INVALIDPUBLICKEY);
 	}
 	rsa->e = BN_bin2bn(r.base, e_bytes, NULL);
-	r.base += e_bytes;
-	r.length -= e_bytes;
+	isc_region_consume(&r, e_bytes);
 
 	rsa->n = BN_bin2bn(r.base, r.length, NULL);
 
 	key->key_size = BN_num_bits(rsa->n);
 
-	isc_buffer_forward(data, r.length);
+	isc_buffer_forward(data, length);
 
 #if USE_EVP
 	pkey = EVP_PKEY_new();
Index: bind-9.6-ESV-R11-W1/lib/dns/resolver.c
===================================================================
--- bind-9.6-ESV-R11-W1.orig/lib/dns/resolver.c	2014-02-11 00:40:00.000000000 +0100
+++ bind-9.6-ESV-R11-W1/lib/dns/resolver.c	2015-09-02 11:15:01.440654623 +0200
@@ -8494,6 +8494,12 @@
 
 	REQUIRE(VALID_RESOLVER(resolver));
 
+	/*
+	 * DH is unsupported for DNSKEYs, see RFC 4034 sec. A.1.
+	 */
+	if ((alg == DST_ALG_DH) || (alg == DST_ALG_INDIRECT))
+		return (ISC_FALSE);
+
 #if USE_ALGLOCK
 	RWLOCK(&resolver->alglock, isc_rwlocktype_read);
 #endif
@@ -8513,6 +8519,7 @@
 #endif
 	if (found)
 		return (ISC_FALSE);
+
 	return (dst_algorithm_supported(alg));
 }
 
