diff --git a/net/dnsmasq/Portfile b/net/dnsmasq/Portfile
index 433cfffa705..6417b136e86 100644
--- a/net/dnsmasq/Portfile
+++ b/net/dnsmasq/Portfile
@@ -3,7 +3,7 @@
 PortSystem          1.0
 
 name                dnsmasq
-version             2.90
+version             2.92
 categories          net
 license             GPL
 maintainers         {snc @nerdling} openmaintainer
@@ -30,11 +30,12 @@ notes               "A startup item has been generated that will aid in\
 master_sites        http://www.thekelleys.org.uk/dnsmasq/
 use_xz              yes
 
-checksums           rmd160  14f493b4a14aed3cdba5820c254f3d8929292489 \
-                    sha256  8e50309bd837bfec9649a812e066c09b6988b73d749b7d293c06c57d46a109e4 \
-                    size    570672
+checksums           rmd160  50d79c46f08389294839065e9a7d66b7a10b7f1f \
+                    sha256  4bf50c2c1018f9fbc26037df51b90ecea0cb73d46162846763b92df0d6c3a458 \
+                    size    637752
 
-patchfiles          patch-src-config.h.diff \
+patchfiles          0000-underflow.diff \
+                    patch-src-config.h.diff \
                     patch-src-network.c.diff
 post-patch {
     reinplace "s|#define SMALLDNAME 50|#define SMALLDNAME 255|g" ${worksrcpath}/src/config.h
diff --git a/net/dnsmasq/files/0000-underflow.diff b/net/dnsmasq/files/0000-underflow.diff
new file mode 100644
index 00000000000..ae1fe5d3236
--- /dev/null
+++ b/net/dnsmasq/files/0000-underflow.diff
@@ -0,0 +1,13 @@
+--- src/rfc1035.c.orig
++++ src/rfc1035.c
+@@ -1624,6 +1624,9 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen,
+   int rd_bit = (header->hb3 & HB3_RD);
+   int count = 255; /* catch loops */
+ 
++  // Make sure we do not underflow here too.
++  if ((ssize_t)qlen > (limit - ((char *)header))) return 0;
++
+   /* Suppress cached answers if no_cache set. */
+   if (no_cache)
+     rd_bit = 0;
+