In validate_rrset() at dnssec.c:546, sig_len is calculated as rdlen - (p - psav) without checking that rdlen is large enough to cover the fixed RRSIG fields and signer name. A crafted RRSIG with a short rdlen makes sig_len go negative, which when passed as a size parameter becomes a huge unsigned value, causing a massive heap OOB read. Fix: check sig_len <= 0 and return STAT_BOGUS before using it.