3670. [bug] Address read after free in server side of

                        lwres_getrrsetbyname. [RT #29075]

(cherry picked from commit eb5e0b8dec22de22dd824959e39b26c4f5b1c52d)

diff --git a/CHANGES b/CHANGES
index 8c5a15548de0d34f3bbc6a254d7780113432d212..b7e41f7dcfca0e6c7b6424f91e0442ca6f070395 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3670.  [bug]           Address read after free in server side of
+                       lwres_getrrsetbyname. [RT #29075]
+
 3669.  [port]          freebsd: --with-gssapi needs -lhx509. [RT #35001]
 
 3668.  [bug]           Fix cast in lex.c which could see 0xff treated as eof.

diff --git a/bin/named/lwdgrbn.c b/bin/named/lwdgrbn.c
index 1244e2572854c0715207f9dd209e51fcce341153..199415fb6e9810054e6b1aa55ccbf5c8a54c04cf 100644 (file)
--- a/bin/named/lwdgrbn.c
+++ b/bin/named/lwdgrbn.c
@@ -324,9 +324,6 @@ lookup_done(isc_task_t *task, isc_event_t *event) {
                                 (grbn->nsigs == 1) ? "" : "s");
        }
 
-       dns_lookup_destroy(&client->lookup);
-       isc_event_free(&event);
-
        /*
         * Render the packet.
         */
@@ -362,6 +359,9 @@ lookup_done(isc_task_t *task, isc_event_t *event) {
 
        NS_LWDCLIENT_SETSEND(client);
 
+       dns_lookup_destroy(&client->lookup);
+       isc_event_free(&event);
+
        return;
 
  out: