fix bug#395: id bits of other query may leak out under conditions

git-svn-id: file:///svn/unbound/trunk@2444 be551aaa-1e26-0410-a405-d3ace91eadb9

diff --git a/daemon/worker.c b/daemon/worker.c
index a9de147259f5391e2bba0346e893b4561ecdea10..616d045eb594cf1f035cf76f45f5a79aa4f1aeb4 100644 (file)
--- a/daemon/worker.c
+++ b/daemon/worker.c
@@ -739,17 +739,21 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
                        worker->stats.unwanted_queries++;
                return 0;
        } else if(acl == acl_refuse) {
+               log_addr(VERB_ALGO, "refused query from",
+                       &repinfo->addr, repinfo->addrlen);
+               log_buf(VERB_ALGO, "refuse", c->buffer);
+               if(worker->stats.extended)
+                       worker->stats.unwanted_queries++;
+               if(worker_check_request(c->buffer, worker) == -1) {
+                       comm_point_drop_reply(repinfo);
+                       return 0; /* discard this */
+               }
                ldns_buffer_set_limit(c->buffer, LDNS_HEADER_SIZE);
                ldns_buffer_write_at(c->buffer, 4, 
                        (uint8_t*)"\0\0\0\0\0\0\0\0", 8);
                LDNS_QR_SET(ldns_buffer_begin(c->buffer));
                LDNS_RCODE_SET(ldns_buffer_begin(c->buffer), 
                        LDNS_RCODE_REFUSED);
-               log_addr(VERB_ALGO, "refused query from",
-                       &repinfo->addr, repinfo->addrlen);
-               log_buf(VERB_ALGO, "refuse", c->buffer);
-               if(worker->stats.extended)
-                       worker->stats.unwanted_queries++;
                return 1;
        }
        if((ret=worker_check_request(c->buffer, worker)) != 0) {

diff --git a/doc/Changelog b/doc/Changelog
index ef194ac678c211bd7f45e6a3bf8988089e6befa1..ab1823ef236acc77e905aaeebd6ab3407328a32d 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,6 +1,7 @@
 30 June 2011: Wouter
        - tag relase 1.4.11, trunk is 1.4.12 development.
        - iana portlist updated.
+       - fix bug#395: id bits of other query may leak out under conditions
 
 23 June 2011: Wouter
        - Changed -flto check to support clang compiler.