From: Mark Andrews <marka@isc.org>
Date: Wed, 11 Dec 2013 23:38:35 +0000 (+1100)
Subject: 3687.   [bug]           Address null pointer dereference in zone_xfrdone.
X-Git-Tag: v9.10.0a2~170
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=00112618bc042f734de7b5ac86506cacb9acf36d;p=thirdparty%2Fbind9.git

3687.   [bug]           Address null pointer dereference in zone_xfrdone.
                        [RT #35042]
---

diff --git a/CHANGES b/CHANGES
index 00fbee83899..4047f383d96 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3687.	[bug]		Address null pointer dereference in zone_xfrdone.
+			[RT #35042]
+
 3686.	[func]		"dnssec-signzone -Q" drops signatures from keys
 			that are still published but no longer active.
 			[RT #34990]
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index f24aa33bad9..f6207931560 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -11856,6 +11856,12 @@ zone_shutdown(isc_task_t *task, isc_event_t *event) {
 			linked = ISC_TRUE;
 			zone->statelist = NULL;
 		}
+		if (zone->statelist == &zone->zmgr->xfrin_in_progress) {
+			ISC_LIST_UNLINK(zone->zmgr->xfrin_in_progress, zone,
+					statelink);
+			zone->statelist = NULL;
+			zmgr_resume_xfrs(zone->zmgr, ISC_FALSE);
+		}
 		RWUNLOCK(&zone->zmgr->rwlock, isc_rwlocktype_write);
 	}
 
@@ -14330,13 +14336,16 @@ zone_xfrdone(dns_zone_t *zone, isc_result_t result) {
 	 * This transfer finishing freed up a transfer quota slot.
 	 * Let any other zones waiting for quota have it.
 	 */
-	UNLOCK_ZONE(zone);
-	RWLOCK(&zone->zmgr->rwlock, isc_rwlocktype_write);
-	ISC_LIST_UNLINK(zone->zmgr->xfrin_in_progress, zone, statelink);
-	zone->statelist = NULL;
-	zmgr_resume_xfrs(zone->zmgr, ISC_FALSE);
-	RWUNLOCK(&zone->zmgr->rwlock, isc_rwlocktype_write);
-	LOCK_ZONE(zone);
+	if (zone->zmgr != NULL &&
+	    zone->statelist == &zone->zmgr->xfrin_in_progress) {
+		UNLOCK_ZONE(zone);
+		RWLOCK(&zone->zmgr->rwlock, isc_rwlocktype_write);
+		ISC_LIST_UNLINK(zone->zmgr->xfrin_in_progress, zone, statelink);
+		zone->statelist = NULL;
+		zmgr_resume_xfrs(zone->zmgr, ISC_FALSE);
+		RWUNLOCK(&zone->zmgr->rwlock, isc_rwlocktype_write);
+		LOCK_ZONE(zone);
+	}
 
 	/*
 	 * Retry with a different server if necessary.