From: Mark Andrews <marka@isc.org>
Date: Tue, 28 Jul 2026 06:23:24 +0000 (+1000)
Subject: dig with IDN output could leak memory on ISC_R_NOSPACE retry
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=69972b514c80f75bb2586a6bfffa867d60f5ecad;p=thirdparty%2Fbind9.git

dig with IDN output could leak memory on ISC_R_NOSPACE retry

The IDN to text display call back could leak the memory holding the
converted name if it did not fit into the buffer.  This has been fixed.
---

diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index cdc925e6c8e..6bb349dbc02 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -4703,6 +4703,7 @@ idn_filter(isc_buffer_t *buffer, unsigned int start) {
 	char *dst = NULL;
 	size_t srclen, dstlen;
 	int res;
+	isc_result_t result;
 
 	/*
 	 * Copy name from 'buffer' to 'src' and terminate it with NULL.
@@ -4722,7 +4723,7 @@ idn_filter(isc_buffer_t *buffer, unsigned int start) {
 	}
 	resetlocale(LC_ALL);
 	if (res != IDN2_OK) {
-		return ISC_R_SUCCESS;
+		CLEANUP(ISC_R_SUCCESS);
 	}
 
 	/*
@@ -4730,14 +4731,18 @@ idn_filter(isc_buffer_t *buffer, unsigned int start) {
 	 */
 	dstlen = strlen(dst);
 	if (isc_buffer_length(buffer) < start + dstlen) {
-		return ISC_R_NOSPACE;
+		CLEANUP(ISC_R_NOSPACE);
 	}
 	isc_buffer_subtract(buffer, srclen);
 	memmove(isc_buffer_used(buffer), dst, dstlen);
 	isc_buffer_add(buffer, dstlen);
 
-	idn2_free(dst);
-	return ISC_R_SUCCESS;
+	result = ISC_R_SUCCESS;
+cleanup:
+	if (dst != NULL) {
+		idn2_free(dst);
+	}
+	return result;
 }
 
 /*%