From: Shawn Routhier <sar@isc.org>
Date: Tue, 9 Oct 2012 21:08:26 +0000 (-0700)
Subject: [master]
X-Git-Tag: v4_3_0a1~65
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=30e4232753ce1eaaa526f8797ab07307752f42b1;p=thirdparty%2Fdhcp.git

[master]
[rt30320]
When processing a failover request with an unexpected name
create an option block the relationship_name instead of using
the one from the incoming message.  This avoids problems when
the option is freed.

Also add code to free the relationship_name from the incoming
mesasage when we free the message.
---

diff --git a/RELNOTES b/RELNOTES
index 7d70f1163..87894fc21 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -127,6 +127,12 @@ work on other platforms. Please report any problems and suggested fixes to
   the TXT record alone.  This relaxation was codified in RFC 4703.
   [ISC-Bugs #30734]
 
+- Modify the failover code to handle incorrect peer names
+  better.  Previously the structure holding the name might
+  have been freed inappropriately in some cases and not
+  freed in other cases.
+  [ISC-Bugs #30320]
+
 			Changes since 4.2.3
 
 ! Add a check for a null pointer before calling the regexec function.
diff --git a/server/failover.c b/server/failover.c
index 45e6b6296..5a6d37fc3 100644
--- a/server/failover.c
+++ b/server/failover.c
@@ -4452,7 +4452,9 @@ isc_result_t dhcp_failover_send_connectack (omapi_object_t *l,
 	       ? dhcp_failover_make_option(FTO_RELATIONSHIP_NAME, FMA,
 					   strlen(state->name), state->name)
 	       : (link->imsg->options_present & FTB_RELATIONSHIP_NAME)
-		  ? &link->imsg->relationship_name
+		  ? dhcp_failover_make_option(FTO_RELATIONSHIP_NAME, FMA,
+					      link->imsg->relationship_name.count,
+					      link->imsg->relationship_name.data)
 		  : &skip_failover_option,
 	      state
 	       ? dhcp_failover_make_option (FTO_MAX_UNACKED, FMA,
@@ -6333,6 +6335,8 @@ static isc_result_t failover_message_dereference (failover_message_t **mp,
 			dfree (m -> hba.data, file, line);
 		if (m -> message.data)
 			dfree (m -> message.data, file, line);
+		if (m -> relationship_name.data)
+			dfree (m -> relationship_name.data, file, line);
 		if (m -> reply_options.data)
 			dfree (m -> reply_options.data, file, line);
 		if (m -> request_options.data)