Prevent check_stale_header() from leaking rdataset headers

check_stale_header() fails to update the pointer to the previous header
while processing rdataset headers eligible for serve-stale, thus
enabling rdataset headers to be leaked (i.e. disassociated from a node
and left on the relevant TTL heap) while iterating through a node.  This
can lead to several different assertion failures.  Add the missing
pointer update.

diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index 64bd7a93bfb791a858a79818f8789ec0eb5a569c..b64350c62df7e1ffae96b57368ac928ae8d5c966 100644 (file)
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -4494,6 +4494,7 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
                 */
                if (KEEPSTALE(search->rbtdb) && stale > search->now) {
                        header->attributes |= RDATASET_ATTR_STALE;
+                       *header_prev = header;
                        return ((search->options & DNS_DBFIND_STALEOK) == 0);
                }