From: Mark Andrews <marka@isc.org>
Date: Wed, 17 Nov 2021 02:09:03 +0000 (+1100)
Subject: validator.c:check_signer now clones val->sigrdataset
X-Git-Tag: v9.21.11~12^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8aa130f253b11e61d87dadea576e2c1430ce8dcc;p=thirdparty%2Fbind9.git

validator.c:check_signer now clones val->sigrdataset

Spurious validation failures were traced back to check_signer looping
over val->sigrdataset directly.  Cloning val->sigrdataset prevents
check_signer from interacting with callers that are also looping
over val->sigrdataset.
---

diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 2d044ccdfc5..c3247cc2d8a 100644
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -1874,11 +1874,14 @@ check_signer(dns_validator_t *val, dns_rdata_t *keyrdata, uint16_t keyid,
 	dns_rdata_rrsig_t sig;
 	dst_key_t *dstkey = NULL;
 	isc_result_t result = ISC_R_NOMORE;
+	dns_rdataset_t rdataset = DNS_RDATASET_INIT;
 
-	DNS_RDATASET_FOREACH (val->sigrdataset) {
+	dns_rdataset_clone(val->sigrdataset, &rdataset);
+
+	DNS_RDATASET_FOREACH (&rdataset) {
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 
-		dns_rdataset_current(val->sigrdataset, &rdata);
+		dns_rdataset_current(&rdataset, &rdata);
 		result = dns_rdata_tostruct(&rdata, &sig, NULL);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		if (keyid != sig.keyid || algorithm != sig.algorithm) {
@@ -1903,6 +1906,7 @@ check_signer(dns_validator_t *val, dns_rdata_t *keyrdata, uint16_t keyid,
 	if (dstkey != NULL) {
 		dst_key_free(&dstkey);
 	}
+	dns_rdataset_disassociate(&rdataset);
 
 	return result;
 }