From: Ondřej Surý <ondrej@isc.org>
Date: Sat, 14 Mar 2026 11:53:29 +0000 (+0100)
Subject: Fix cb_args memory leak in ns_query() error path
X-Git-Tag: v9.21.21~41^2~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d7e1013741e3921f0f18246d15ef6f800ada77a2;p=thirdparty%2Fbind9.git

Fix cb_args memory leak in ns_query() error path

Initialize cb_args to NULL and free it in the cleanup path so it
is not leaked when the function fails after allocation.
---

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 693e048f899..8f6ded67174 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -14261,7 +14261,7 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 	bool reqnsid;
 	uint16_t udpsize = SEND_BUFFER_SIZE;
 	isc_sockaddr_t curraddr, sourceaddr;
-	struct stub_cb_args *cb_args;
+	struct stub_cb_args *cb_args = NULL;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
 	REQUIRE(LOCKED_ZONE(zone));
@@ -14480,6 +14480,9 @@ cleanup:
 	if (stub->zone != NULL) {
 		zone_idetach(&stub->zone);
 	}
+	if (cb_args != NULL) {
+		isc_mem_put(zone->mctx, cb_args, sizeof(*cb_args));
+	}
 	isc_mem_put(stub->mctx, stub, sizeof(*stub));
 	if (message != NULL) {
 		dns_message_detach(&message);