From: Mark Andrews <marka@isc.org>
Date: Tue, 12 Nov 2013 04:00:03 +0000 (+1100)
Subject: 3670.   [bug]           Address read after free in server side of
X-Git-Tag: v9.6-ESV-R11b1~24
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6500789c9c0fd7a2b43a6f50550e4ae149ad94cf;p=thirdparty%2Fbind9.git

3670.   [bug]           Address read after free in server side of
                        lwres_getrrsetbyname. [RT #29075]

(cherry picked from commit eb5e0b8dec22de22dd824959e39b26c4f5b1c52d)
---

diff --git a/CHANGES b/CHANGES
index 8c5a15548de..b7e41f7dcfc 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3670.	[bug]		Address read after free in server side of
+			lwres_getrrsetbyname. [RT #29075]
+
 3669.	[port]		freebsd: --with-gssapi needs -lhx509. [RT #35001]
 
 3668.	[bug]		Fix cast in lex.c which could see 0xff treated as eof.
diff --git a/bin/named/lwdgrbn.c b/bin/named/lwdgrbn.c
index 1244e257285..199415fb6e9 100644
--- a/bin/named/lwdgrbn.c
+++ b/bin/named/lwdgrbn.c
@@ -324,9 +324,6 @@ lookup_done(isc_task_t *task, isc_event_t *event) {
 				 (grbn->nsigs == 1) ? "" : "s");
 	}
 
-	dns_lookup_destroy(&client->lookup);
-	isc_event_free(&event);
-
 	/*
 	 * Render the packet.
 	 */
@@ -362,6 +359,9 @@ lookup_done(isc_task_t *task, isc_event_t *event) {
 
 	NS_LWDCLIENT_SETSEND(client);
 
+	dns_lookup_destroy(&client->lookup);
+	isc_event_free(&event);
+
 	return;
 
  out: