- Fix #1284: NULL pointer deref in az_find_nsec_cover() (latent bug)

  by adding a log_assert() to safeguard future development.

diff --git a/doc/Changelog b/doc/Changelog
index 8d4a93ff65ffbd7abfea28755655733c4d3924aa..3b169e7939002af3b93db778d9c115e7b4948ccb 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,7 @@
+13 May 2025: Yorgos
+       - Fix #1284: NULL pointer deref in az_find_nsec_cover() (latent bug)
+         by adding a log_assert() to safeguard future development.
+
 12 May 2025: Yorgos
        - Merge #1280: Fix auth nsec3 code. Fixes NSEC3 code to not break on
          broken auth zones that include unsigned out of zone (above apex)

diff --git a/services/authzone.c b/services/authzone.c
index 7d1df032e2d23f4f139c3bf0b2a180f63a5c9622..40530d3a5426920c45afd49ff7fad81cc93e29f4 100644 (file)
--- a/services/authzone.c
+++ b/services/authzone.c
@@ -2767,21 +2767,18 @@ az_change_dnames(struct dns_msg* msg, uint8_t* oldname, uint8_t* newname,
        }
 }
 
-/** find NSEC record covering the query */
+/** find NSEC record covering the query, with the given node in the zone */
 static struct auth_rrset*
 az_find_nsec_cover(struct auth_zone* z, struct auth_data** node)
 {
-       uint8_t* nm = (*node)->name;
-       size_t nmlen = (*node)->namelen;
+       uint8_t* nm;
+       size_t nmlen;
        struct auth_rrset* rrset;
+       log_assert(*node); /* we already have a node when calling this */
+       nm = (*node)->name;
+       nmlen = (*node)->namelen;
        /* find the NSEC for the smallest-or-equal node */
-       /* if node == NULL, we did not find a smaller name.  But the zone
-        * name is the smallest name and should have an NSEC. So there is
-        * no NSEC to return (for a properly signed zone) */
-       /* for empty nonterminals, the auth-data node should not exist,
-        * and thus we don't need to go rbtree_previous here to find
-        * a domain with an NSEC record */
-       /* but there could be glue, and if this is node, then it has no NSEC.
+       /* But there could be glue, and then it has no NSEC.
         * Go up to find nonglue (previous) NSEC-holding nodes */
        while((rrset=az_domain_rrset(*node, LDNS_RR_TYPE_NSEC)) == NULL) {
                if(nmlen == z->namelen) return NULL;
@@ -3393,7 +3390,7 @@ az_generate_answer_with_node(struct auth_zone* z, struct query_info* qinfo,
 }
 
 /** Generate answer without an existing-node that we can use.
- * So it'll be a referral, DNAME or nxdomain */
+ * So it'll be a referral, DNAME, notype, wildcard or nxdomain */
 static int
 az_generate_answer_nonexistnode(struct auth_zone* z, struct query_info* qinfo,
        struct regional* region, struct dns_msg* msg, struct auth_data* ce,