From: W.C.A. Wijngaards Date: Tue, 16 Jun 2026 08:51:49 +0000 (+0200) Subject: - Fix that after malloc failure in find_tag_datas, the X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=215e3920ef5616566d116ecd083085f2d742d7aa;p=thirdparty%2Funbound.git - Fix that after malloc failure in find_tag_datas, the local_alias is cleaned up. Thanks to Qifan Zhang, Palo Alto Networks, for the report. --- diff --git a/doc/Changelog b/doc/Changelog index 2672f3319..742ae0100 100644 --- a/doc/Changelog +++ b/doc/Changelog @@ -47,6 +47,9 @@ - Fix incorrect cleanup after an allocation failure for a delegation point. Thanks to Qifan Zhang, Palo Alto Networks, for the report. + - Fix that after malloc failure in find_tag_datas, the + local_alias is cleaned up. Thanks to Qifan Zhang, Palo + Alto Networks, for the report. 15 June 2026: Wouter - Fix to add `max-transfer-size` and `max-transfer-time` that diff --git a/services/localzone.c b/services/localzone.c index a5c11faf5..8eebd962a 100644 --- a/services/localzone.c +++ b/services/localzone.c @@ -1502,8 +1502,10 @@ find_tag_datas(struct query_info* qinfo, struct config_strlist* list, return 0; /* out of memory */ qinfo->local_alias->rrset = regional_alloc_init(temp, r, sizeof(*r)); - if(!qinfo->local_alias->rrset) + if(!qinfo->local_alias->rrset) { + qinfo->local_alias = NULL; return 0; /* out of memory */ + } } return result; } diff --git a/util/data/msgencode.c b/util/data/msgencode.c index b1311111b..8e55e13f1 100644 --- a/util/data/msgencode.c +++ b/util/data/msgencode.c @@ -1129,9 +1129,11 @@ extended_error_encode(sldns_buffer* buf, uint16_t rcode, sldns_buffer_write(buf, &flags, sizeof(uint16_t)); sldns_buffer_write(buf, &flags, sizeof(uint16_t)); if(qinfo) { - const uint8_t* qname = qinfo->local_alias ? + const uint8_t* qname = + (qinfo->local_alias && qinfo->local_alias->rrset) ? qinfo->local_alias->rrset->rk.dname : qinfo->qname; - size_t qname_len = qinfo->local_alias ? + size_t qname_len = + (qinfo->local_alias && qinfo->local_alias->rrset) ? qinfo->local_alias->rrset->rk.dname_len : qinfo->qname_len; if(sldns_buffer_current(buf) == qname)