From: Aram Sargsyan <aram@isc.org>
Date: Fri, 14 Aug 2026 15:40:54 +0000 (+0000)
Subject: dns_tkey_gssnegotiate: copy 'tkeyname' before resetting the message
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ae566116bd3e04b55223d32e8b086d33b759b82d;p=thirdparty%2Fbind9.git

dns_tkey_gssnegotiate: copy 'tkeyname' before resetting the message

Commit 63e58ad048e4 added multi-round client support for
GSS_S_CONTINUE_NEEDED and deliberately copied tkeyname before resetting
the message. Commit f4084ff54378 ("minor tkey-related fixups") removed
that copy while converting the TKEY struct initialization.

The dns_message_reset() API documents that names must not be used
after reset, so using the name at 'tkeyname' is a use-after-free bug.

Bring back the original code which makes a local copy of 'tkeyname'
before calling the dns_message_reset() function.
---

diff --git a/lib/dns/tkey.c b/lib/dns/tkey.c
index 86532cfafe..10c4e60b1d 100644
--- a/lib/dns/tkey.c
+++ b/lib/dns/tkey.c
@@ -663,6 +663,15 @@ dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg,
 
 		dns_name_clone(DNS_TSIG_GSSAPI_NAME, &tkey.algorithm);
 
+		/*
+		 * 'tkeyname' gets destroyed by dns_message_reset(), create a
+		 * local copy of it for buildquery().
+		 */
+		dns_fixedname_t fixed;
+		dns_fixedname_init(&fixed);
+		dns_name_copy(tkeyname, dns_fixedname_name(&fixed));
+		tkeyname = dns_fixedname_name(&fixed);
+
 		dns_message_reset(qmsg, DNS_MESSAGE_INTENTRENDER);
 		CHECK(buildquery(qmsg, tkeyname, &tkey));
 		return DNS_R_CONTINUE;