From: Ondřej Surý <ondrej@sury.org>
Date: Fri, 27 Sep 2019 08:35:49 +0000 (+0200)
Subject: lib/dns/rbtdb.c: Add DbC check to safely dereference rbtdb in rbt_datafixer()
X-Git-Tag: v9.15.6~72^2~16
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d508ce4036ce4431b8e6a58697cf890bed6db341;p=thirdparty%2Fbind9.git

lib/dns/rbtdb.c: Add DbC check to safely dereference rbtdb in rbt_datafixer()
---

diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index cef118c5ce9..26d0f1a41ec 100644
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -7081,17 +7081,14 @@ rbt_datafixer(dns_rbtnode_t *rbtnode, void *base, size_t filesize,
 	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *) arg;
 	rdatasetheader_t *header;
 	unsigned char *limit = ((unsigned char *) base) + filesize;
-	unsigned char *p;
-	size_t size;
-	unsigned int count;
 
 	REQUIRE(rbtnode != NULL);
+	REQUIRE(VALID_RBTDB(rbtdb));
 
 	for (header = rbtnode->data; header != NULL; header = header->next) {
-		p = (unsigned char *) header;
-
-		size = dns_rdataslab_size(p, sizeof(*header));
-		count = dns_rdataslab_count(p, sizeof(*header));;
+		unsigned char *p = (unsigned char *) header;
+		size_t size = dns_rdataslab_size(p, sizeof(*header));
+		unsigned int count = dns_rdataslab_count(p, sizeof(*header));;
 		rbtdb->current_version->records += count;
 		rbtdb->current_version->bytes += size;
 		isc_crc64_update(crc, p, size);
@@ -7105,7 +7102,7 @@ rbt_datafixer(dns_rbtnode_t *rbtnode, void *base, size_t filesize,
 		header->node = rbtnode;
 		header->node_is_relative = 0;
 
-		if (rbtdb != NULL && RESIGN(header) &&
+		if (RESIGN(header) &&
 		    (header->resign != 0 || header->resign_lsb != 0))
 		{
 			int idx = header->node->locknum;