dns_tkey_gssnegotiate: copy 'tkeyname' before resetting the message

Commit 63e58ad048e4 added multi-round client support for
GSS_S_CONTINUE_NEEDED and deliberately copied tkeyname before resetting
the message. Commit f4084ff54378 ("minor tkey-related fixups") removed
that copy while converting the TKEY struct initialization.

The dns_message_reset() API documents that names must not be used
after reset, so using the name at 'tkeyname' is a use-after-free bug.

Bring back the original code which makes a local copy of 'tkeyname'
before calling the dns_message_reset() function.

diff --git a/lib/dns/tkey.c b/lib/dns/tkey.c
index 86532cfafe2a29c90e851491ed31cab77578e9ba..10c4e60b1d3f676e8ed571ce1f924a4bd520446d 100644 (file)
--- a/lib/dns/tkey.c
+++ b/lib/dns/tkey.c
@@ -663,6 +663,15 @@ dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg,
 
                dns_name_clone(DNS_TSIG_GSSAPI_NAME, &tkey.algorithm);
 
+               /*
+                * 'tkeyname' gets destroyed by dns_message_reset(), create a
+                * local copy of it for buildquery().
+                */
+               dns_fixedname_t fixed;
+               dns_fixedname_init(&fixed);
+               dns_name_copy(tkeyname, dns_fixedname_name(&fixed));
+               tkeyname = dns_fixedname_name(&fixed);
+
                dns_message_reset(qmsg, DNS_MESSAGE_INTENTRENDER);
                CHECK(buildquery(qmsg, tkeyname, &tkey));
                return DNS_R_CONTINUE;