diff --git a/config.h.in b/config.h.in

index 04356f3..3b06bfa 100644

--- a/config.h.in

+++ b/config.h.in

@@ -666,6 +666,9 @@

 /* Shared data */

 #undef SHARE_DIR

+/* The size of `size_t', as computed by sizeof. */

+#undef SIZEOF_SIZE_T

+

 /* The size of `time_t', as computed by sizeof. */

 #undef SIZEOF_TIME_T

diff --git a/configure.ac b/configure.ac

index c5e0c7b..1bff4ed 100644

--- a/configure.ac

+++ b/configure.ac

@@ -371,6 +371,7 @@ AC_INCLUDES_DEFAULT

 # endif

 #endif

 ])

+AC_CHECK_SIZEOF(size_t)

 # add option to disable the evil rpath

 ACX_ARG_RPATH

diff --git a/contrib/create_unbound_ad_servers.sh b/contrib/create_unbound_ad_servers.sh

index d31f078..49fdbff 100644

--- a/contrib/create_unbound_ad_servers.sh

+++ b/contrib/create_unbound_ad_servers.sh

@@ -9,12 +9,13 @@

 # Variables

 dst_dir="/etc/opt/csw/unbound"

 work_dir="/tmp"

-list_addr="http://pgl.yoyo.org/adservers/serverlist.php?hostformat=nohtml&showintro=1&startdate%5Bday%5D=&startdate%5Bmonth%5D=&startdate%5Byear%5D="

+list_addr="https://pgl.yoyo.org/adservers/serverlist.php?hostformat=nohtml&showintro=1&startdate%5Bday%5D=&startdate%5Bmonth%5D=&startdate%5Byear%5D="

 # OS commands

 CAT=`which cat`

 ECHO=`which echo`

 WGET=`which wget`

+TR=`which tr`

 # Check Wget installed

 if [ ! -f $WGET ]; then

@@ -22,8 +23,10 @@ if [ ! -f $WGET ]; then

  exit 1

 fi

+# remove special characters with tr to protect unbound.conf

 $WGET -O $work_dir/yoyo_ad_servers "$list_addr" && \

 $CAT $work_dir/yoyo_ad_servers | \

+$TR -d '";$\\' | \

 while read line ; \

  do \

    $ECHO "local-zone: \"$line\" redirect" ;\

@@ -36,4 +39,4 @@ echo "Done."

 #  the unbound_ad_servers file:

 #

 #   include: $dst_dir/unbound_ad_servers

-#

\ No newline at end of file

+#

diff --git a/daemon/daemon.c b/daemon/daemon.c

index 6820e11..1b4f329 100644

--- a/daemon/daemon.c

+++ b/daemon/daemon.c

@@ -426,9 +426,7 @@ daemon_create_workers(struct daemon* daemon)

 	int* shufport;

 	log_assert(daemon && daemon->cfg);

 	if(!daemon->rand) {

-		unsigned int seed = (unsigned int)time(NULL) ^ 

-			(unsigned int)getpid() ^ 0x438;

-		daemon->rand = ub_initstate(seed, NULL);

+		daemon->rand = ub_initstate(NULL);

 		if(!daemon->rand)

 			fatal_exit("could not init random generator");

 		hash_set_raninit((uint32_t)ub_random(daemon->rand));

diff --git a/daemon/worker.c b/daemon/worker.c

index 3acecc1..8354010 100644

--- a/daemon/worker.c

+++ b/daemon/worker.c

@@ -1629,18 +1629,14 @@ worker_create(struct daemon* daemon, int id, int* ports, int n)

 		return NULL;

 	}

 	/* create random state here to avoid locking trouble in RAND_bytes */

-	seed = (unsigned int)time(NULL) ^ (unsigned int)getpid() ^

-		(((unsigned int)worker->thread_num)<<17);

-		/* shift thread_num so it does not match out pid bits */

-	if(!(worker->rndstate = ub_initstate(seed, daemon->rand))) {

-		seed = 0;

+	if(!(worker->rndstate = ub_initstate(daemon->rand))) {

 		log_err("could not init random numbers.");

 		tube_delete(worker->cmd);

 		free(worker->ports);

 		free(worker);

 		return NULL;

 	}

-	seed = 0;

+	explicit_bzero(&seed, sizeof(seed));

 #ifdef USE_DNSTAP

 	if(daemon->cfg->dnstap) {

 		log_assert(daemon->dtenv != NULL);

diff --git a/dns64/dns64.c b/dns64/dns64.c

index 7889d72..300202c 100644

--- a/dns64/dns64.c

+++ b/dns64/dns64.c

@@ -782,6 +782,16 @@ dns64_inform_super(struct module_qstate* qstate, int id,

 	 * Signal that the sub-query is finished, no matter whether we are

 	 * successful or not. This lets the state machine terminate.

 	 */

+	if(!super->minfo[id]) {

+		super->minfo[id] = (enum dns64_qstate *)regional_alloc(super->region,

+			sizeof(*(super->minfo[id])));

+		if(!super->minfo[id]) {

+			log_err("out of memory");

+			super->return_rcode = LDNS_RCODE_SERVFAIL;

+			super->return_msg = NULL;

+			return;

+		}

+	}

	super->minfo[id] = (void*)DNS64_SUBQUERY_FINISHED;

 	/* If there is no successful answer, we're done. */

diff --git a/dnscrypt/dnscrypt.c b/dnscrypt/dnscrypt.c

index 3545d3d..7dd2ce5 100644

--- a/dnscrypt/dnscrypt.c

+++ b/dnscrypt/dnscrypt.c

@@ -732,6 +732,11 @@ dnsc_load_local_data(struct dnsc_env* dnscenv, struct config_file *cfg)

             );

             continue;

         }

+        if((unsigned)strlen(dnscenv->provider_name) >= (unsigned)0xffff0000) {

+		    /* guard against integer overflow in rrlen calculation */

+		    verbose(VERB_OPS, "cert #%" PRIu32 " is too long", serial);

+		    continue;

+        }

         rrlen = strlen(dnscenv->provider_name) +

                          strlen(ttl_class_type) +

                          4 * sizeof(struct SignedCert) + // worst case scenario

diff --git a/doc/Changelog b/doc/Changelog

index bb74461..4cb080e 100644

--- a/doc/Changelog

+++ b/doc/Changelog

@@ -1,3 +1,55 @@

+3 December 2019: Wouter

+	- Fix Assert Causing DoS in synth_cname(),

+	  reported by X41 D-Sec.

+	- Fix Assert Causing DoS in dname_pkt_copy(),

+	  reported by X41 D-Sec.

+	- Fix OOB Read in sldns_wire2str_dname_scan(),

+	  reported by X41 D-Sec.

+	- Fix Out of Bounds Write in sldns_str2wire_str_buf(),

+	  reported by X41 D-Sec.

+	- Fix Out of Bounds Write in sldns_b64_pton(),

+	  fixed by check in sldns_str2wire_int16_data_buf(),

+	  reported by X41 D-Sec.

+	- Fix Insufficient Handling of Compressed Names in dname_pkt_copy(),

+	  reported by X41 D-Sec.

+	- Fix Out of Bound Write Compressed Names in rdata_copy(),

+	  reported by X41 D-Sec.

+	- Fix Hang in sldns_wire2str_pkt_scan(),

+	  reported by X41 D-Sec.

+

+20 November 2019: Wouter

+	- Fix Out of Bounds Read in rrinternal_get_owner(),

+	  reported by X41 D-Sec.

+	- Fix Race Condition in autr_tp_create(),

+	  reported by X41 D-Sec.

+	- Fix Shared Memory World Writeable,

+	  reported by X41 D-Sec.

+	- Adjust unbound-control to make stats_shm a read only operation.

+	- Fix Weak Entropy Used For Nettle,

+	  reported by X41 D-Sec.

+	- Fix Randomness Error not Handled Properly,

+	  reported by X41 D-Sec.

+	- Fix Out-of-Bounds Read in dname_valid(),

+	  reported by X41 D-Sec.

+	- Fix Config Injection in create_unbound_ad_servers.sh,

+	  reported by X41 D-Sec.

+

+19 November 2019: Wouter

+	- Fix Integer Overflow in Regional Allocator,

+	  reported by X41 D-Sec.

+	- Fix Unchecked NULL Pointer in dns64_inform_super()

+	  and ipsecmod_new(), reported by X41 D-Sec.

+	- Fix Out-of-bounds Read in rr_comment_dnskey(),

+	  reported by X41 D-Sec.

+	- Fix Integer Overflows in Size Calculations,

+	  reported by X41 D-Sec.

+	- Fix Integer Overflow to Buffer Overflow in

+	  sldns_str2wire_dname_buf_origin(), reported by X41 D-Sec.

+	- Fix Out of Bounds Read in sldns_str2wire_dname(),

+	  reported by X41 D-Sec.

+	- Fix Out of Bounds Write in sldns_bget_token_par(),

+	  reported by X41 D-Sec.

+

 30 November 2018: Wouter

 	- log-tag-queryreply: yes in unbound.conf tags the log-queries and

 	  log-replies in the log file for easier log filter maintenance.

diff --git a/ipsecmod/ipsecmod.c b/ipsecmod/ipsecmod.c

index 3572f12..1422a62 100644

--- a/ipsecmod/ipsecmod.c

+++ b/ipsecmod/ipsecmod.c

@@ -103,11 +103,11 @@ ipsecmod_new(struct module_qstate* qstate, int id)

 {

 	struct ipsecmod_qstate* iq = (struct ipsecmod_qstate*)regional_alloc(

 		qstate->region, sizeof(struct ipsecmod_qstate));

-	memset(iq, 0, sizeof(*iq));

 	qstate->minfo[id] = iq;

 	if(!iq)

 		return 0;

 	/* Initialise it. */

+	memset(iq, 0, sizeof(*iq));

 	iq->enabled = qstate->env->cfg->ipsecmod_enabled;

 	iq->is_whitelisted = ipsecmod_domain_is_whitelisted(

 		(struct ipsecmod_env*)qstate->env->modinfo[id], qstate->qinfo.qname,

diff --git a/iterator/iter_scrub.c b/iterator/iter_scrub.c

index 8230d17..942c3d5 100644

--- a/iterator/iter_scrub.c

+++ b/iterator/iter_scrub.c

@@ -231,6 +231,10 @@ synth_cname(uint8_t* qname, size_t qnamelen, struct rrset_parse* dname_rrset,

 	size_t dtarglen;

 	if(!parse_get_cname_target(dname_rrset, &dtarg, &dtarglen, pkt))

 		return 0; 

+	if(qnamelen <= dname_rrset->dname_len)

+		return 0;

+	if(qnamelen == 0)

+		return 0;

 	log_assert(qnamelen > dname_rrset->dname_len);

 	/* DNAME from com. to net. with qname example.com. -> example.net. */

 	/* so: \3com\0 to \3net\0 and qname \7example\3com\0 */

diff --git a/libunbound/libunbound.c b/libunbound/libunbound.c

index 275e8d2..a8979c2 100644

--- a/libunbound/libunbound.c

+++ b/libunbound/libunbound.c

@@ -83,7 +83,6 @@

 static struct ub_ctx* ub_ctx_create_nopipe(void)

 {

 	struct ub_ctx* ctx;

-	unsigned int seed;

 #ifdef USE_WINSOCK

 	int r;

 	WSADATA wsa_data;

@@ -107,15 +106,12 @@ static struct ub_ctx* ub_ctx_create_nopipe(void)

 		return NULL;

 	}

 	alloc_init(&ctx->superalloc, NULL, 0);

-	seed = (unsigned int)time(NULL) ^ (unsigned int)getpid();

-	if(!(ctx->seed_rnd = ub_initstate(seed, NULL))) {

-		seed = 0;

+	if(!(ctx->seed_rnd = ub_initstate(NULL))) {

 		ub_randfree(ctx->seed_rnd);

 		free(ctx);

 		errno = ENOMEM;

 		return NULL;

 	}

-	seed = 0;

 	lock_basic_init(&ctx->qqpipe_lock);

 	lock_basic_init(&ctx->rrpipe_lock);

 	lock_basic_init(&ctx->cfglock);

diff --git a/libunbound/libworker.c b/libunbound/libworker.c

index 3dcaa78..07a08c6 100644

--- a/libunbound/libworker.c

+++ b/libunbound/libworker.c

@@ -122,7 +122,6 @@ libworker_delete_event(struct libworker* w)

 static struct libworker*

 libworker_setup(struct ub_ctx* ctx, int is_bg, struct ub_event_base* eb)

 {

-	unsigned int seed;

 	struct libworker* w = (struct libworker*)calloc(1, sizeof(*w));

 	struct config_file* cfg = ctx->env->cfg;

 	int* ports;

@@ -177,17 +176,13 @@ libworker_setup(struct ub_ctx* ctx, int is_bg, struct ub_event_base* eb)

 	}

 	w->env->worker = (struct worker*)w;

 	w->env->probe_timer = NULL;

-	seed = (unsigned int)time(NULL) ^ (unsigned int)getpid() ^

-		(((unsigned int)w->thread_num)<<17);

-	seed ^= (unsigned int)w->env->alloc->next_id;

 	if(!w->is_bg || w->is_bg_thread) {

 		lock_basic_lock(&ctx->cfglock);

 	}

-	if(!(w->env->rnd = ub_initstate(seed, ctx->seed_rnd))) {

+	if(!(w->env->rnd = ub_initstate(ctx->seed_rnd))) {

 		if(!w->is_bg || w->is_bg_thread) {

 			lock_basic_unlock(&ctx->cfglock);

 		}

-		seed = 0;

 		libworker_delete(w);

 		return NULL;

 	}

@@ -207,7 +202,6 @@ libworker_setup(struct ub_ctx* ctx, int is_bg, struct ub_event_base* eb)

 			hash_set_raninit((uint32_t)ub_random(w->env->rnd));

 		}

 	}

-	seed = 0;

 	if(eb)

 		w->base = comm_base_create_event(eb);

diff --git a/respip/respip.c b/respip/respip.c

index 2e9313f..7d2a588 100644

--- a/respip/respip.c

+++ b/respip/respip.c

@@ -475,10 +475,16 @@ copy_rrset(const struct ub_packed_rrset_key* key, struct regional* region)

 	if(!ck->rk.dname)

 		return NULL;

+	if((unsigned)data->count >= 0xffff00U)

+		return NULL; /* guard against integer overflow in dsize */

 	dsize = sizeof(struct packed_rrset_data) + data->count *

 		(sizeof(size_t)+sizeof(uint8_t*)+sizeof(time_t));

-	for(i=0; i<data->count; i++)

+	for(i=0; i<data->count; i++) {

+		if((unsigned)dsize >= 0x0fffffffU ||

+			(unsigned)data->rr_len[i] >= 0x0fffffffU)

+			return NULL; /* guard against integer overflow */

 		dsize += data->rr_len[i];

+	}

 	d = regional_alloc(region, dsize);

 	if(!d)

 		return NULL;

diff --git a/sldns/parse.c b/sldns/parse.c

index b62c405..b30264e 100644

--- a/sldns/parse.c

+++ b/sldns/parse.c

@@ -325,8 +325,14 @@ sldns_bget_token_par(sldns_buffer *b, char *token, const char *delim,

 		if (c == '\n' && p != 0) {

 			/* in parentheses */

 			/* do not write ' ' if we want to skip spaces */

-			if(!(skipw && (strchr(skipw, c)||strchr(skipw, ' '))))

+			if(!(skipw && (strchr(skipw, c)||strchr(skipw, ' ')))) {

+				/* check for space for the space character */

+				if (limit > 0 && (i >= limit || (size_t)(t-token) >= limit)) {

+					*t = '\0';

+					return -1;

+				}

 				*t++ = ' ';

+			}

 			lc = c;

 			continue;

 		}

diff --git a/sldns/str2wire.c b/sldns/str2wire.c

index 1a51bb6..414b7b8 100644

--- a/sldns/str2wire.c

+++ b/sldns/str2wire.c

@@ -150,6 +150,10 @@ int sldns_str2wire_dname_buf_origin(const char* str, uint8_t* buf, size_t* len,

 	if(s) return s;

 	if(rel && origin && dlen > 0) {

+		if((unsigned)dlen >= 0x00ffffffU ||

+			(unsigned)origin_len >= 0x00ffffffU)

+			/* guard against integer overflow in addition */

+			return RET_ERR(LDNS_WIREPARSE_ERR_GENERAL, *len);

 		if(dlen + origin_len - 1 > LDNS_MAX_DOMAINLEN)

 			return RET_ERR(LDNS_WIREPARSE_ERR_DOMAINNAME_OVERFLOW,

 				LDNS_MAX_DOMAINLEN);

@@ -168,7 +172,9 @@ uint8_t* sldns_str2wire_dname(const char* str, size_t* len)

 	uint8_t dname[LDNS_MAX_DOMAINLEN+1];

 	*len = sizeof(dname);

 	if(sldns_str2wire_dname_buf(str, dname, len) == 0) {

-		uint8_t* r = (uint8_t*)malloc(*len);

+		uint8_t* r;

+		if(*len > sizeof(dname)) return NULL;

+		r = (uint8_t*)malloc(*len);

 		if(r) return memcpy(r, dname, *len);

 	}

 	*len = 0;

@@ -187,6 +193,9 @@ rrinternal_get_owner(sldns_buffer* strbuf, uint8_t* rr, size_t* len,

 			sldns_buffer_position(strbuf));

 	}

+	if(token_len < 2) /* make sure there is space to read "@" or "" */

+		return RET_ERR(LDNS_WIREPARSE_ERR_BUFFER_TOO_SMALL,

+			sldns_buffer_position(strbuf));

 	if(strcmp(token, "@") == 0) {

 		uint8_t* tocopy;

 		if (origin) {

@@ -1094,7 +1103,7 @@ int sldns_str2wire_str_buf(const char* str, uint8_t* rd, size_t* len)

 	while(sldns_parse_char(&ch, &s)) {

 		if(sl >= 255)

 			return RET_ERR(LDNS_WIREPARSE_ERR_INVALID_STR, s-str);

-		if(*len < sl+1)

+		if(*len < sl+2)

 			return RET_ERR(LDNS_WIREPARSE_ERR_BUFFER_TOO_SMALL,

 				s-str);

 		rd[++sl] = ch;

@@ -2095,6 +2104,8 @@ int sldns_str2wire_int16_data_buf(const char* str, uint8_t* rd, size_t* len)

 	char* s;

 	int n;

 	n = strtol(str, &s, 10);

+	if(n < 0) /* negative number not allowed */

+		return LDNS_WIREPARSE_ERR_SYNTAX;

 	if(*len < ((size_t)n)+2)

 		return LDNS_WIREPARSE_ERR_BUFFER_TOO_SMALL;

 	if(n > 65535)

diff --git a/sldns/wire2str.c b/sldns/wire2str.c

index 832239f..a95c9b3 100644

--- a/sldns/wire2str.c

+++ b/sldns/wire2str.c

@@ -585,6 +585,7 @@ static int rr_comment_dnskey(char** s, size_t* slen, uint8_t* rr,

 	if(rrlen < dname_off + 10) return 0;

 	rdlen = sldns_read_uint16(rr+dname_off+8);

 	if(rrlen < dname_off + 10 + rdlen) return 0;

+	if(rdlen < 2) return 0;

 	rdata = rr + dname_off + 10;

 	flags = (int)sldns_read_uint16(rdata);

 	w += sldns_str_print(s, slen, " ;{");

@@ -781,7 +782,7 @@ int sldns_wire2str_dname_scan(uint8_t** d, size_t* dlen, char** s, size_t* slen,

 	/* spool labels onto the string, use compression if its there */

 	uint8_t* pos = *d;

 	unsigned i, counter=0;

-	const unsigned maxcompr = 1000; /* loop detection, max compr ptrs */

+	const unsigned maxcompr = 256; /* loop detection, max compr ptrs */

 	int in_buf = 1;

 	if(*dlen == 0) return sldns_str_print(s, slen, "ErrorMissingDname");

 	if(*pos == 0) {

@@ -789,7 +790,7 @@ int sldns_wire2str_dname_scan(uint8_t** d, size_t* dlen, char** s, size_t* slen,

 		(*dlen)--;

 		return sldns_str_print(s, slen, ".");

 	}

-	while(*pos) {

+	while((!pkt || pos < pkt+pktlen) && *pos) {

 		/* read label length */

 		uint8_t labellen = *pos++;

 		if(in_buf) { (*d)++; (*dlen)--; }

diff --git a/smallapp/unbound-control.c b/smallapp/unbound-control.c

index d165417..2884309 100644

--- a/smallapp/unbound-control.c

+++ b/smallapp/unbound-control.c

@@ -407,19 +407,19 @@ static void print_stats_shm(const char* cfgfile)

 	if(!config_read(cfg, cfgfile, NULL))

 		fatal_exit("could not read config file");

 	/* get shm segments */

-	id_ctl = shmget(cfg->shm_key, sizeof(int), SHM_R|SHM_W);

+	id_ctl = shmget(cfg->shm_key, sizeof(int), SHM_R);

 	if(id_ctl == -1) {

 		fatal_exit("shmget(%d): %s", cfg->shm_key, strerror(errno));

 	}

-	id_arr = shmget(cfg->shm_key+1, sizeof(int), SHM_R|SHM_W);

+	id_arr = shmget(cfg->shm_key+1, sizeof(int), SHM_R);

 	if(id_arr == -1) {

 		fatal_exit("shmget(%d): %s", cfg->shm_key+1, strerror(errno));

 	}

-	shm_stat = (struct ub_shm_stat_info*)shmat(id_ctl, NULL, 0);

+	shm_stat = (struct ub_shm_stat_info*)shmat(id_ctl, NULL, SHM_RDONLY);

 	if(shm_stat == (void*)-1) {

 		fatal_exit("shmat(%d): %s", id_ctl, strerror(errno));

 	}

-	stats = (struct ub_stats_info*)shmat(id_arr, NULL, 0);

+	stats = (struct ub_stats_info*)shmat(id_arr, NULL, SHM_RDONLY);

 	if(stats == (void*)-1) {

 		fatal_exit("shmat(%d): %s", id_arr, strerror(errno));

 	}

diff --git a/testcode/unitmain.c b/testcode/unitmain.c

index fecde80..96a6654 100644

--- a/testcode/unitmain.c

+++ b/testcode/unitmain.c

@@ -537,10 +537,8 @@ rnd_test(void)

 	struct ub_randstate* r;

 	int num = 1000, i;

 	long int a[1000];

-	unsigned int seed = (unsigned)time(NULL);

 	unit_show_feature("ub_random");

-	printf("ub_random seed is %u\n", seed);

-	unit_assert( (r = ub_initstate(seed, NULL)) );

+	unit_assert( (r = ub_initstate(NULL)) );

 	for(i=0; i

 		a[i] = ub_random(r);

 		unit_assert(a[i] >= 0);

diff --git a/util/data/dname.c b/util/data/dname.c

index b744f06..923be02 100644

--- a/util/data/dname.c

+++ b/util/data/dname.c

@@ -75,6 +75,8 @@ dname_valid(uint8_t* dname, size_t maxlen)

 {

 	size_t len = 0;

 	size_t labellen;

+	if(maxlen == 0)

+		return 0; /* too short, shortest is '0' root label */

 	labellen = *dname++;

 	while(labellen) {

 		if(labellen&0xc0)

@@ -345,11 +347,17 @@ dname_pkt_hash(sldns_buffer* pkt, uint8_t* dname, hashvalue_type h)

 void dname_pkt_copy(sldns_buffer* pkt, uint8_t* to, uint8_t* dname)

 {

 	/* copy over the dname and decompress it at the same time */

+	size_t comprcount = 0;

 	size_t len = 0;

 	uint8_t lablen;

 	lablen = *dname++;

 	while(lablen) {

 		if(LABEL_IS_PTR(lablen)) {

+			if(comprcount++ > MAX_COMPRESS_PTRS) {

+				/* too many compression pointers */

+				*to = 0; /* end the result prematurely */

+				return;

+			}

 			/* follow pointer */

             if((size_t)PTR_OFFSET(lablen, *dname)

                 >= sldns_buffer_limit(pkt))

@@ -358,6 +366,10 @@ void dname_pkt_copy(sldns_buffer* pkt, uint8_t* to, uint8_t* dname)

 			lablen = *dname++;

 			continue;

 		}

+		if(lablen > LDNS_MAX_LABELLEN) {

+			*to = 0; /* end the result prematurely */

+			return;

+		}

 		log_assert(lablen <= LDNS_MAX_LABELLEN);

 		len += (size_t)lablen+1;

 		if(len >= LDNS_MAX_DOMAINLEN) {

diff --git a/util/data/msgreply.c b/util/data/msgreply.c

index df2131c..dbae34d 100644

--- a/util/data/msgreply.c

+++ b/util/data/msgreply.c

@@ -238,10 +238,10 @@ rdata_copy(sldns_buffer* pkt, struct packed_rrset_data* data, uint8_t* to,

 				break;

 			}

 			if(len) {

+				log_assert(len <= pkt_len);

 				memmove(to, sldns_buffer_current(pkt), len);

 				to += len;

 				sldns_buffer_skip(pkt, (ssize_t)len);

-				log_assert(len <= pkt_len);

 				pkt_len -= len;

 			}

 			rdf++;

diff --git a/util/random.c b/util/random.c

index 8332960..9380502 100644

--- a/util/random.c

+++ b/util/random.c

@@ -86,8 +86,7 @@ ub_systemseed(unsigned int ATTR_UNUSED(seed))

 }

 struct ub_randstate* 

-ub_initstate(unsigned int ATTR_UNUSED(seed),

-	struct ub_randstate* ATTR_UNUSED(from))

+ub_initstate(struct ub_randstate* ATTR_UNUSED(from))

 {

 	struct ub_randstate* s = (struct ub_randstate*)malloc(1);

 	if(!s) {

@@ -123,8 +122,8 @@ void ub_systemseed(unsigned int ATTR_UNUSED(seed))

 {

 }

-struct ub_randstate* ub_initstate(unsigned int ATTR_UNUSED(seed), 

-	struct ub_randstate* ATTR_UNUSED(from))

+struct ub_randstate* 

+ub_initstate(struct ub_randstate* ATTR_UNUSED(from))

 {

 	struct ub_randstate* s = (struct ub_randstate*)calloc(1, sizeof(*s));

 	if(!s) {

@@ -140,7 +139,9 @@ long int ub_random(struct ub_randstate* ATTR_UNUSED(state))

 	/* random 31 bit value. */

 	SECStatus s = PK11_GenerateRandom((unsigned char*)&x, (int)sizeof(x));

 	if(s != SECSuccess) {

-		log_err("PK11_GenerateRandom error: %s",

+		/* unbound needs secure randomness for randomized

+		 * ID bits and port numbers in packets to upstream servers */

+		fatal_exit("PK11_GenerateRandom error: %s",

 			PORT_ErrorToString(PORT_GetError()));

 	}

 	return x & MAX_VALUE;

@@ -166,8 +167,7 @@ void ub_systemseed(unsigned int ATTR_UNUSED(seed))

 	log_err("Re-seeding not supported, generator untouched");

 }

-struct ub_randstate* ub_initstate(unsigned int seed,

-	struct ub_randstate* ATTR_UNUSED(from))

+struct ub_randstate* ub_initstate(struct ub_randstate* ATTR_UNUSED(from))

 {

 	struct ub_randstate* s = (struct ub_randstate*)calloc(1, sizeof(*s));

 	uint8_t buf[YARROW256_SEED_FILE_SIZE];

@@ -183,15 +183,10 @@ struct ub_randstate* ub_initstate(unsigned int seed,

 		yarrow256_seed(&s->ctx, YARROW256_SEED_FILE_SIZE, buf);

 		s->seeded = yarrow256_is_seeded(&s->ctx);

 	} else {

-		/* Stretch the uint32 input seed and feed it to Yarrow */

-		uint32_t v = seed;

-		size_t i;

-		for(i=0; i < (YARROW256_SEED_FILE_SIZE/sizeof(seed)); i++) {

-			memmove(buf+i*sizeof(seed), &v, sizeof(seed));

-			v = v*seed + (uint32_t)i;

-		}

-		yarrow256_seed(&s->ctx, YARROW256_SEED_FILE_SIZE, buf);

-		s->seeded = yarrow256_is_seeded(&s->ctx);

+		log_err("nettle random(yarrow) cannot initialize, "

+			"getentropy failed: %s", strerror(errno));

+		free(s);

+		return NULL;

 	}

 	return s;

diff --git a/util/random.h b/util/random.h

index a05a994..e75157d 100644

--- a/util/random.h

+++ b/util/random.h

@@ -57,15 +57,12 @@ void ub_systemseed(unsigned int seed);

 /**

  * Initialize a random generator state for use 

- * @param seed: seed value to create state contents.

- *	(ignored for arc4random).

  * @param from: if not NULL, the seed is taken from this random structure.

  * 	can be used to seed random states via a parent-random-state that

  * 	is itself seeded with entropy.

  * @return new state or NULL alloc failure.

  */

-struct ub_randstate* ub_initstate(unsigned int seed, 

-	struct ub_randstate* from);

+struct ub_randstate* ub_initstate(struct ub_randstate* from);

 /**

  * Generate next random number from the state passed along.

diff --git a/util/regional.c b/util/regional.c

index 899a54e..5be09eb 100644

--- a/util/regional.c

+++ b/util/regional.c

@@ -120,8 +120,18 @@ regional_destroy(struct regional *r)

 void *

 regional_alloc(struct regional *r, size_t size)

 {

-	size_t a = ALIGN_UP(size, ALIGNMENT);

+	size_t a;

 	void *s;

+	if(

+#if SIZEOF_SIZE_T == 8

+		(unsigned long long)size >= 0xffffffffffffff00ULL

+#else

+		(unsigned)size >= (unsigned)0xffffff00UL

+#endif

+		)

+		return NULL; /* protect against integer overflow in

+			malloc and ALIGN_UP */

+	a = ALIGN_UP(size, ALIGNMENT);

 	/* large objects */

 	if(a > REGIONAL_LARGE_OBJECT_SIZE) {

 		s = malloc(ALIGNMENT + size);

diff --git a/util/shm_side/shm_main.c b/util/shm_side/shm_main.c

index a783c09..69bee4d 100644

--- a/util/shm_side/shm_main.c

+++ b/util/shm_side/shm_main.c

@@ -121,7 +121,7 @@ int shm_main_init(struct daemon* daemon)

 		shmctl(daemon->shm_info->id_arr, IPC_RMID, NULL);

 	/* SHM: Create the segment */

-	daemon->shm_info->id_ctl = shmget(daemon->shm_info->key, sizeof(struct ub_shm_stat_info), IPC_CREAT | 0666);

+	daemon->shm_info->id_ctl = shmget(daemon->shm_info->key, sizeof(struct ub_shm_stat_info), IPC_CREAT | 0644);

 	if (daemon->shm_info->id_ctl < 0)

 	{

@@ -134,7 +134,7 @@ int shm_main_init(struct daemon* daemon)

 		return 0;

 	}

-	daemon->shm_info->id_arr = shmget(daemon->shm_info->key + 1, shm_size, IPC_CREAT | 0666);

+	daemon->shm_info->id_arr = shmget(daemon->shm_info->key + 1, shm_size, IPC_CREAT | 0644);

 	if (daemon->shm_info->id_arr < 0)

 	{

diff --git a/validator/autotrust.c b/validator/autotrust.c

index 7bc5577..e19bd7b 100644

--- a/validator/autotrust.c

+++ b/validator/autotrust.c

@@ -370,10 +370,10 @@ autr_tp_create(struct val_anchors* anchors, uint8_t* own, size_t own_len,

 		free(tp);

 		return NULL;

 	}

-	lock_basic_unlock(&anchors->lock);

 	lock_basic_init(&tp->lock);

 	lock_protect(&tp->lock, tp, sizeof(*tp));

 	lock_protect(&tp->lock, tp->autr, sizeof(*tp->autr));

+	lock_basic_unlock(&anchors->lock);

 	return tp;

 }