From: Michał Kępień <michal@isc.org>
Date: Mon, 13 Jun 2022 12:03:16 +0000 (+0200)
Subject: Check for NULL before dereferencing qctx->rpz_st
X-Git-Tag: v9.19.3~57^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=07592d1315412c38c978e8d009aace5d0f5bef93;p=thirdparty%2Fbind9.git

Check for NULL before dereferencing qctx->rpz_st

Commit 9ffb4a7ba11fae64a6ce2dd6390cd334372b7ab7 causes Clang Static
Analyzer to flag a potential NULL dereference in query_nxdomain():

    query.c:9394:26: warning: Dereference of null pointer [core.NullDereference]
            if (!qctx->nxrewrite || qctx->rpz_st->m.rpz->addsoa) {
                                    ^~~~~~~~~~~~~~~~~~~
    1 warning generated.

The warning above is for qctx->rpz_st potentially being a NULL pointer
when query_nxdomain() is called from query_resume().  This is a false
positive because none of the database lookup result codes currently
causing query_nxdomain() to be called (DNS_R_EMPTYWILD, DNS_R_NXDOMAIN)
can be returned by a database lookup following a recursive resolution
attempt.  Add a NULL check nevertheless in order to future-proof the
code and silence Clang Static Analyzer.
---

diff --git a/lib/ns/query.c b/lib/ns/query.c
index 2f0608faaa5..18c6a820e19 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -9391,7 +9391,8 @@ query_nxdomain(query_ctx_t *qctx, isc_result_t res) {
 	{
 		ttl = 0;
 	}
-	if (!qctx->nxrewrite || qctx->rpz_st->m.rpz->addsoa) {
+	if (!qctx->nxrewrite ||
+	    (qctx->rpz_st != NULL && qctx->rpz_st->m.rpz->addsoa)) {
 		result = query_addsoa(qctx, ttl, section);
 		if (result != ISC_R_SUCCESS) {
 			QUERY_ERROR(qctx, result);