- Fix that malloc failure in dns64_inform_super does

  not set up a half-built reply for cache store, that could
  lead to a crash. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.

diff --git a/dns64/dns64.c b/dns64/dns64.c
index ca39bd96416232fc6749c4a1a1fe88ff4e02135b..8f9dba82f12d9c062ce6050a5eb0aed784f84243 100644 (file)
--- a/dns64/dns64.c
+++ b/dns64/dns64.c
@@ -955,8 +955,10 @@ dns64_adjust_ptr(struct module_qstate* qstate, struct module_qstate* super)
         return;
     super->return_msg->qinfo = super->qinfo;
     if (!(super->return_msg->rep = reply_info_copy(qstate->return_msg->rep,
-                    NULL, super->region)))
+                    NULL, super->region))) {
+       super->return_msg = NULL;
         return;
+    }
 
     /*
      * Adjust the domain name of the answer RR set so that it matches the

diff --git a/doc/Changelog b/doc/Changelog
index dced5c76c9f609fd5d9a5c9079845e8791e337e5..ce19e50a4d07d27313572a6b8c3442ae9d30e9a2 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -14,6 +14,10 @@
        - Fix that unbound-control auth_zone_reload stops the
          server answering from the zone after a failure to read.
          Thanks to Qifan Zhang, Palo Alto Networks, for the report.
+       - Fix that malloc failure in dns64_inform_super does
+         not set up a half-built reply for cache store, that could
+         lead to a crash. Thanks to Qifan Zhang, Palo Alto Networks,
+         for the report.
 
 16 June 2026: Wouter
        - Fix to disallow $INCLUDE for secondary zones. Start up