- Fix incorrect cleanup after an allocation failure for

  a delegation point in a region. Thanks to Qifan Zhang,
  Palo Alto Networks, for the report.

diff --git a/doc/Changelog b/doc/Changelog
index be8b537781d8fda41a278d9402678e15a184e84d..a20fbc5340e3368745e587b90ae99fed5e04e7eb 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -53,6 +53,9 @@
        - Fix that after shared memory cannot be created, from
          `shm-enable`, the server does not crash. Thanks to Qifan
          Zhang, Palo Alto Networks, for the report.
+       - Fix incorrect cleanup after an allocation failure for
+         a delegation point in a region. Thanks to Qifan Zhang,
+         Palo Alto Networks, for the report.
 
 15 June 2026: Wouter
        - Fix to add `max-transfer-size` and `max-transfer-time` that

diff --git a/iterator/iter_delegpt.c b/iterator/iter_delegpt.c
index 7f3bef943e3fc0b651076a1c53cb717b36d1e9c1..6ba12c443ba8eccd492bf9055ef88c15190a7e23 100644 (file)
--- a/iterator/iter_delegpt.c
+++ b/iterator/iter_delegpt.c
@@ -118,10 +118,10 @@ delegpt_add_ns(struct delegpt* dp, struct regional* region, uint8_t* name,
                sizeof(struct delegpt_ns));
        if(!ns)
                return 0;
-       ns->next = dp->nslist;
        ns->namelen = len;
-       dp->nslist = ns;
        ns->name = regional_alloc_init(region, name, ns->namelen);
+       if(!ns->name)
+               return 0;
        ns->cache_lookup_count = 0;
        ns->resolved = 0;
        ns->got4 = 0;
@@ -137,7 +137,9 @@ delegpt_add_ns(struct delegpt* dp, struct regional* region, uint8_t* name,
        } else {
                ns->tls_auth_name = NULL;
        }
-       return ns->name != 0;
+       ns->next = dp->nslist;
+       dp->nslist = ns;
+       return 1;
 }
 
 struct delegpt_ns*
@@ -223,11 +225,7 @@ delegpt_add_addr(struct delegpt* dp, struct regional* region,
                sizeof(struct delegpt_addr));
        if(!a)
                return 0;
-       a->next_target = dp->target_list;
-       dp->target_list = a;
        a->next_result = 0;
-       a->next_usable = dp->usable_list;
-       dp->usable_list = a;
        memcpy(&a->addr, addr, addrlen);
        a->addrlen = addrlen;
        a->attempts = 0;
@@ -241,6 +239,10 @@ delegpt_add_addr(struct delegpt* dp, struct regional* region,
        } else {
                a->tls_auth_name = NULL;
        }
+       a->next_target = dp->target_list;
+       dp->target_list = a;
+       a->next_usable = dp->usable_list;
+       dp->usable_list = a;
        return 1;
 }
 

diff --git a/services/cache/dns.c b/services/cache/dns.c
index 79a23a77556fae96f5c3a08cc4b17ce851f728e1..9731ff1fa4826dda9138af92a0ea91a6b7ac81bf 100644 (file)
--- a/services/cache/dns.c
+++ b/services/cache/dns.c
@@ -584,8 +584,11 @@ dns_cache_find_delegation(struct module_env* env, uint8_t* qname,
                        return NULL;
                }
        }
-       if(!delegpt_rrset_add_ns(dp, region, nskey, 0))
+       if(!delegpt_rrset_add_ns(dp, region, nskey, 0)) {
+               lock_rw_unlock(&nskey->entry.lock);
                log_err("find_delegation: addns out of memory");
+               return NULL;
+       }
        lock_rw_unlock(&nskey->entry.lock); /* first unlock before next lookup*/
        /* find and add DS/NSEC (if any) */
        if(msg)