From: Alessio Podda <alessio@isc.org>
Date: Mon, 27 Apr 2026 17:15:00 +0000 (+0000)
Subject: sec: usr: Fix race condition in getsigningtime()
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d35a527ffb019dde765b92554e557b13f4cf7f1f;p=thirdparty%2Fbind9.git

sec: usr: Fix race condition in getsigningtime()

Compute qpzone_get_lock(elem->node) into a local variable while the
heap lock is still held, rather than dereferencing the stale elem
pointer after releasing the lock. A concurrent thread running
setsigningtime() (e.g. via IXFR apply on a worker thread) could free
the top-of-heap element between the heap lock release and the
dereference, causing a use-after-free.

Closes #5883

Merge branch '5883-getsigningtime-race-fix' into 'main'

See merge request isc-projects/bind9!11875
---

d35a527ffb019dde765b92554e557b13f4cf7f1f