Fix unprotected access to rbtnode in lib/dns/rbtdb.c:add32()

diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index 3033e8f58611d58298ab6c3c667083264bd72369..d7d65c047bb8b4d493b7511aa8f27a44e48e1e9f 100644 (file)
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -6263,16 +6263,18 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
                        INSIST(!loading);
                        INSIST(rbtversion == NULL ||
                               rbtversion->serial >= topheader->serial);
-                       if (topheader_prev != NULL)
+                       if (topheader_prev != NULL) {
                                topheader_prev->next = newheader;
-                       else
+                       } else {
                                rbtnode->data = newheader;
+                       }
                        newheader->next = topheader->next;
                        newheader->down = topheader;
                        topheader->next = newheader;
                        rbtnode->dirty = 1;
-                       if (changed != NULL)
+                       if (changed != NULL) {
                                changed->dirty = true;
+                       }
                } else {
                        /*
                         * No rdatasets of the given type exist at the node.
@@ -7058,8 +7060,15 @@ loading_addrdataset(void *arg, const dns_name_t *name,
                newheader->resign_lsb = 0;
        }
 
+       NODE_LOCK(&rbtdb->node_locks[node->locknum].lock,
+                 isc_rwlocktype_write);
+
        result = add32(rbtdb, node, rbtdb->current_version, newheader,
                       DNS_DBADD_MERGE, true, NULL, 0);
+
+       NODE_UNLOCK(&rbtdb->node_locks[node->locknum].lock,
+                   isc_rwlocktype_write);
+
        if (result == ISC_R_SUCCESS &&
            delegating_type(rbtdb, node, rdataset->type))
                node->find_callback = 1;