From: Wouter Wijngaards <wouter@nlnetlabs.nl>
Date: Thu, 16 May 2013 07:36:37 +0000 (+0000)
Subject: - Fix use-after-free in out-of-memory handling code (thanks Jake
X-Git-Tag: release-1.4.21rc1~26
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=416df19f6d983f2282bbf946856ffcec5330ec08;p=thirdparty%2Funbound.git

- Fix use-after-free in out-of-memory handling code (thanks Jake
  Montgomery).


git-svn-id: file:///svn/unbound/trunk@2900 be551aaa-1e26-0410-a405-d3ace91eadb9
---

diff --git a/doc/Changelog b/doc/Changelog
index bd5397ea7..9e8aff2fb 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,7 @@
+16 May 2013: Wouter
+	- Fix use-after-free in out-of-memory handling code (thanks Jake
+	  Montgomery).
+
 15 May 2013: Wouter
 	- Fix round-robin doesn't work with some Windows clients (from Ilya
 	  Bakulin).
diff --git a/validator/val_neg.c b/validator/val_neg.c
index eec2eb1b6..83f0df5a3 100644
--- a/validator/val_neg.c
+++ b/validator/val_neg.c
@@ -494,8 +494,8 @@ static struct val_neg_zone* neg_zone_chain(
 			struct val_neg_zone* p=first, *np;
 			while(p) {
 				np = p->parent;
-				free(p);
 				free(p->name);
+				free(p);
 				p = np;
 			}
 			return NULL;
@@ -640,8 +640,8 @@ static struct val_neg_data* neg_data_chain(
 			struct val_neg_data* p = first, *np;
 			while(p) {
 				np = p->parent;
-				free(p);
 				free(p->name);
+				free(p);
 				p = np;
 			}
 			return NULL;