From: Ondřej Surý <ondrej@isc.org>
Date: Sat, 14 Mar 2026 11:53:29 +0000 (+0100)
Subject: Fix cb_args memory leak in ns_query() error path
X-Git-Tag: v9.20.22~29^2~3
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=dc419568d1d0d7b05d532f8f0880bd5ec5a9cbf2;p=thirdparty%2Fbind9.git

Fix cb_args memory leak in ns_query() error path

Initialize cb_args to NULL and free it in the cleanup path so it
is not leaked when the function fails after allocation.

(cherry picked from commit d7e1013741e3921f0f18246d15ef6f800ada77a2)
---

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 705795d443c..2887d09e8c4 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -14794,7 +14794,7 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 	bool reqnsid;
 	uint16_t udpsize = SEND_BUFFER_SIZE;
 	isc_sockaddr_t curraddr, sourceaddr;
-	struct stub_cb_args *cb_args;
+	struct stub_cb_args *cb_args = NULL;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
 	REQUIRE(LOCKED_ZONE(zone));
@@ -15016,6 +15016,9 @@ cleanup:
 	if (stub->zone != NULL) {
 		zone_idetach(&stub->zone);
 	}
+	if (cb_args != NULL) {
+		isc_mem_put(zone->mctx, cb_args, sizeof(*cb_args));
+	}
 	isc_mem_put(stub->mctx, stub, sizeof(*stub));
 	if (message != NULL) {
 		dns_message_detach(&message);