[master]

[rt30320]
When processing a failover request with an unexpected name
create an option block the relationship_name instead of using
the one from the incoming message.  This avoids problems when
the option is freed.

Also add code to free the relationship_name from the incoming
mesasage when we free the message.

diff --git a/RELNOTES b/RELNOTES
index 7d70f11637db91504c4b11a58f430136a81878f2..87894fc2179d9970f3da9521869ffe0b19d7d145 100644 (file)
--- a/RELNOTES
+++ b/RELNOTES
@@ -127,6 +127,12 @@ work on other platforms. Please report any problems and suggested fixes to
   the TXT record alone.  This relaxation was codified in RFC 4703.
   [ISC-Bugs #30734]
 
+- Modify the failover code to handle incorrect peer names
+  better.  Previously the structure holding the name might
+  have been freed inappropriately in some cases and not
+  freed in other cases.
+  [ISC-Bugs #30320]
+
                        Changes since 4.2.3
 
 ! Add a check for a null pointer before calling the regexec function.

diff --git a/server/failover.c b/server/failover.c
index 45e6b62963c262299c4a6ffa066f416aa9ab3cce..5a6d37fc3bc040c9dcba856fee5209d6027d0f09 100644 (file)
--- a/server/failover.c
+++ b/server/failover.c
@@ -4452,7 +4452,9 @@ isc_result_t dhcp_failover_send_connectack (omapi_object_t *l,
               ? dhcp_failover_make_option(FTO_RELATIONSHIP_NAME, FMA,
                                           strlen(state->name), state->name)
               : (link->imsg->options_present & FTB_RELATIONSHIP_NAME)
-                 ? &link->imsg->relationship_name
+                 ? dhcp_failover_make_option(FTO_RELATIONSHIP_NAME, FMA,
+                                             link->imsg->relationship_name.count,
+                                             link->imsg->relationship_name.data)
                  : &skip_failover_option,
              state
               ? dhcp_failover_make_option (FTO_MAX_UNACKED, FMA,
@@ -6333,6 +6335,8 @@ static isc_result_t failover_message_dereference (failover_message_t **mp,
                        dfree (m -> hba.data, file, line);
                if (m -> message.data)
                        dfree (m -> message.data, file, line);
+               if (m -> relationship_name.data)
+                       dfree (m -> relationship_name.data, file, line);
                if (m -> reply_options.data)
                        dfree (m -> reply_options.data, file, line);
                if (m -> request_options.data)