- Fix after malloc failure the rrset_insert_rr in

  localzone processing, during RPZ qname trigger processing,
  the RRset retains its previous data correcly. Thanks to
  Qifan Zhang, Palo Alto Networks, for the report.

diff --git a/doc/Changelog b/doc/Changelog
index a20fbc5340e3368745e587b90ae99fed5e04e7eb..de4c077609f097465a6d8708fdded317d1f7c5e3 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -56,6 +56,10 @@
        - Fix incorrect cleanup after an allocation failure for
          a delegation point in a region. Thanks to Qifan Zhang,
          Palo Alto Networks, for the report.
+       - Fix after malloc failure the rrset_insert_rr in
+         localzone processing, during RPZ qname trigger processing,
+         the RRset retains its previous data correcly. Thanks to
+         Qifan Zhang, Palo Alto Networks, for the report.
 
 15 June 2026: Wouter
        - Fix to add `max-transfer-size` and `max-transfer-time` that

diff --git a/services/localzone.c b/services/localzone.c
index 8eebd962a1640d4fb4ea159018e0d95492c31d16..7ad9376a93cf133fa9f6fdd32750b6b9f9a1acee 100644 (file)
--- a/services/localzone.c
+++ b/services/localzone.c
@@ -431,6 +431,10 @@ rrset_insert_rr(struct regional* region, struct packed_rrset_data* pd,
        pd->rr_ttl = regional_alloc(region, sizeof(*pd->rr_ttl)*pd->count);
        pd->rr_data = regional_alloc(region, sizeof(*pd->rr_data)*pd->count);
        if(!pd->rr_len || !pd->rr_ttl || !pd->rr_data) {
+               pd->count--;
+               pd->rr_len = oldlen;
+               pd->rr_ttl = oldttl;
+               pd->rr_data = olddata;
                log_err("out of memory");
                return 0;
        }
@@ -446,6 +450,10 @@ rrset_insert_rr(struct regional* region, struct packed_rrset_data* pd,
        pd->rr_ttl[0] = ttl;
        pd->rr_data[0] = regional_alloc_init(region, rdata, rdata_len);
        if(!pd->rr_data[0]) {
+               pd->count--;
+               pd->rr_len = oldlen;
+               pd->rr_ttl = oldttl;
+               pd->rr_data = olddata;
                log_err("out of memory");
                return 0;
        }