Fix bug #201

git-svn-id: file:///svn/unbound/trunk@1173 be551aaa-1e26-0410-a405-d3ace91eadb9

diff --git a/doc/Changelog b/doc/Changelog
index ed11fc7a64f360ed7dae717144bdd78346937582..b90fb75e98bcfe7683db0ab173fe98f7977f498a 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,6 +1,7 @@
 4 August 2008: Wouter
        - iana port update. 
        - TODO update.
+       - fix bug 201: null ptr deref on cleanup while udp pkts wait for port.
 
 30 July 2008: Wouter
        - fixup bug qtype DS for unsigned zone and signed parent validation.

diff --git a/services/outside_network.c b/services/outside_network.c
index 9b1cf8159b3b6b5703cbd42e274c2933bfef8ed3..c15d3842585d59fc7826ab01d3a380f72ef6cf93 100644 (file)
--- a/services/outside_network.c
+++ b/services/outside_network.c
@@ -668,6 +668,23 @@ pending_delete(struct outside_network* outnet, struct pending* p)
 {
        if(!p)
                return;
+       if(outnet && outnet->udp_wait_first &&
+               (p->next_waiting || p == outnet->udp_wait_last) ) {
+               /* delete from waiting list, if it is in the waiting list */
+               struct pending* prev = NULL, *x = outnet->udp_wait_first;
+               while(x && x != p) {
+                       prev = x;
+                       x = x->next_waiting;
+               }
+               if(x) {
+                       log_assert(x == p);
+                       if(prev)
+                               prev->next_waiting = p->next_waiting;
+                       else    outnet->udp_wait_first = p->next_waiting;
+                       if(outnet->udp_wait_last == p)
+                               outnet->udp_wait_last = prev;
+               }
+       }
        if(outnet) {
                (void)rbtree_delete(outnet->pending, p->node.key);
        }
@@ -1067,7 +1084,8 @@ serviced_delete(struct serviced_query* sq)
                if(sq->status == serviced_query_UDP_EDNS ||
                        sq->status == serviced_query_UDP) {
                        struct pending* p = (struct pending*)sq->pending;
-                       portcomm_loweruse(sq->outnet, p->pc);
+                       if(p->pc)
+                               portcomm_loweruse(sq->outnet, p->pc);
                        pending_delete(sq->outnet, p);
                        outnet_send_wait_udp(sq->outnet);
                } else {