From 62a46a7990f4dd0d0003f5b6c7c0e8fae841334b Mon Sep 17 00:00:00 2001
From: Chris Hofstaedtler <chris.hofstaedtler@deduktiva.com>
Date: Sat, 12 Aug 2023 15:31:44 +0200
Subject: [PATCH] Auth: always initialize id passed to dk.addKey

---
 pdns/pdnsutil.cc | 11 +++++------
 pdns/ws-auth.cc  |  4 ++--
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/pdns/pdnsutil.cc b/pdns/pdnsutil.cc
index bdf0d3347b..52ea3bd029 100644
--- a/pdns/pdnsutil.cc
+++ b/pdns/pdnsutil.cc
@@ -2265,7 +2265,7 @@ static bool showZone(DNSSECKeeper& dk, const DNSName& zone, bool exportDS = fals
 static bool secureZone(DNSSECKeeper& dk, const DNSName& zone)
 {
   // temp var for addKey
-  int64_t id;
+  int64_t id{-1};
 
   // parse attribute
   string k_algo = ::arg()["default-ksk-algorithm"];
@@ -3068,7 +3068,7 @@ try
         return EXIT_FAILURE;
       }
     }
-    int64_t id;
+    int64_t id{-1};
     if (!dk.addKey(zone, keyOrZone, algorithm, id, bits, active, published)) {
       cerr<<"Adding key failed, perhaps DNSSEC not enabled in configuration?"<<endl;
       return 1;
@@ -3577,7 +3577,7 @@ try
     }
     dpk.setKey(key, flags, algo);
 
-    int64_t id;
+    int64_t id{-1};
     if (!dk.addKey(DNSName(zone), dpk, id)) {
       cerr << "Adding key failed, perhaps DNSSEC not enabled in configuration?" << endl;
       return 1;
@@ -3633,7 +3633,7 @@ try
     }
     dpk.setKey(key, flags, algo);
 
-    int64_t id;
+    int64_t id{-1};
     if (!dk.addKey(DNSName(zone), dpk, id, active, published)) {
       cerr<<"Adding key failed, perhaps DNSSEC not enabled in configuration?"<<endl;
       return 1;
@@ -3963,7 +3963,6 @@ try
         return 1;
       }
 
-      int64_t id;
       bool keyOrZone = (cmds.at(4) == "ksk" ? true : false);
       string module = cmds.at(5);
       string slot = cmds.at(6);
@@ -3996,8 +3995,8 @@ try
 
       // make sure this key isn't being reused.
       B.getDomainKeys(zone, keys);
-      id = -1;
 
+      int64_t id{-1};
       for(DNSBackend::KeyData& kd :  keys) {
         if (kd.content == iscString.str()) {
           // it's this one, I guess...
diff --git a/pdns/ws-auth.cc b/pdns/ws-auth.cc
index 8f6775c6e1..fc8d7832fa 100644
--- a/pdns/ws-auth.cc
+++ b/pdns/ws-auth.cc
@@ -629,14 +629,14 @@ static void addDefaultDNSSECKeys(DNSSECKeeper& dk, const DNSName& zonename) {
   int z_size = arg().asNum("default-zsk-size");
 
   if (k_algo != -1) {
-    int64_t id;
+    int64_t id{-1};
     if (!dk.addKey(zonename, true, k_algo, id, k_size)) {
       throwUnableToSecure(zonename);
     }
   }
 
   if (z_algo != -1) {
-    int64_t id;
+    int64_t id{-1};
     if (!dk.addKey(zonename, false, z_algo, id, z_size)) {
       throwUnableToSecure(zonename);
     }
-- 
2.47.2