- Fix that malloc failure in auth-zone insert rr does

  not create an empty node and does not cause an infinite
  loop. Thanks to Qifan Zhang, Palo Alto Networks, for
  the report.

diff --git a/doc/Changelog b/doc/Changelog
index 266c848979bc6a776eb3006aa02ef10b2c1467d2..37762f6eedf143ac458178998ad84e403275a1f3 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -7,6 +7,10 @@
        - Fix that unbound-checkconf checks if an auth-zone download
          can overwrite another file, by filename collision.
          Thanks to Qifan Zhang, Palo Alto Networks, for the report.
+       - Fix that malloc failure in auth-zone insert rr does
+         not create an empty node and does not cause an infinite
+         loop. Thanks to Qifan Zhang, Palo Alto Networks, for
+         the report.
 
 16 June 2026: Wouter
        - Fix to disallow $INCLUDE for secondary zones. Start up

diff --git a/services/authzone.c b/services/authzone.c
index f5f4356b1037f296debed0be8e12892bcb0441c0..430674b0cb75259b8b02885d2b9f1c2cb6070f40 100644 (file)
--- a/services/authzone.c
+++ b/services/authzone.c
@@ -1204,6 +1204,10 @@ az_insert_rr(struct auth_zone* z, uint8_t* rr, size_t rr_len,
        if(!az_domain_add_rr(node, rr_type, rr_ttl, rdata, rdatalen,
                duplicate)) {
                log_err("cannot add RR to domain");
+               if(node->rrsets == NULL) {
+                       (void)rbtree_delete(&z->data, node);
+                       auth_data_delete(node);
+               }
                return 0;
        }
        if(z->rpz) {
@@ -2703,7 +2707,7 @@ az_empty_nonterminal(struct auth_zone* z, struct query_info* qinfo,
        while(next && (rbnode_type*)next != RBTREE_NULL && next->rrsets == NULL) {
                /* the next name has empty rrsets, is an empty nonterminal
                 * itself, see if there exists something below it */
-               next = (struct auth_data*)rbtree_next(&node->node);
+               next = (struct auth_data*)rbtree_next(&next->node);
        }
        if((rbnode_type*)next == RBTREE_NULL || !next) {
                /* there is no next node, so something below it cannot