pullup:

running out of memory during ns_client_t construction could crash server
[RT #409]

diff --git a/bin/named/client.c b/bin/named/client.c
index 272571b39402d5109bc3a0fc4ea8a29c3665fa0c..d166a02127422d22487502beee89f74782cddb3e 100644 (file)
--- a/bin/named/client.c
+++ b/bin/named/client.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: client.c,v 1.136.2.8 2001/10/12 01:08:20 marka Exp $ */
+/* $Id: client.c,v 1.136.2.9 2001/10/30 01:14:00 marka Exp $ */
 
 #include <config.h>
 
@@ -1542,9 +1542,6 @@ client_create(ns_clientmgr_t *manager, ns_client_t **clientp)
        if (result != ISC_R_SUCCESS)
                goto cleanup_client;
        isc_task_setname(client->task, "client", client);
-       result = isc_task_onshutdown(client->task, client_shutdown, client);
-       if (result != ISC_R_SUCCESS)
-               goto cleanup_task;
 
        client->timer = NULL;
        result = isc_timer_create(manager->timermgr, isc_timertype_inactive,
@@ -1616,12 +1613,19 @@ client_create(ns_clientmgr_t *manager, ns_client_t **clientp)
        if (result != ISC_R_SUCCESS)
                goto cleanup_sendbuf;
 
+       result = isc_task_onshutdown(client->task, client_shutdown, client);
+       if (result != ISC_R_SUCCESS)
+               goto cleanup_query;
+
        CTRACE("create");
 
        *clientp = client;
 
        return (ISC_R_SUCCESS);
 
+ cleanup_query:
+       ns_query_free(client);
+
  cleanup_sendbuf:
        isc_mem_put(manager->mctx, client->sendbuf, SEND_BUFFER_SIZE);