2004. [bug] dns_tsig_sign() could pass a NULL pointer to

                        dst_context_destroy() when cleaning up after a
                        error. [RT #15835]

diff --git a/CHANGES b/CHANGES
index 5363ddfeac08d3c13e4a8c8482767c3aeacfb467..01d6ddf50f36a69e4bcdd53da1a0d668e0dcf47e 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+2004.  [bug]           dns_tsig_sign() could pass a NULL pointer to
+                       dst_context_destroy() when cleaning up after a
+                       error. [RT #15835]
+
 2003.  [bug]           libbind: The DNS name/address lookup functions could
                        occasionally follow a random pointer due to
                        structures not being completely zeroed. [RT #15806]

diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
index f05b7047b239ea9c9199ad7c9852a077239c4bbb..09dc222d1124337df44fe8047ac247408f2a3604 100644 (file)
--- a/lib/dns/tsig.c
+++ b/lib/dns/tsig.c
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: tsig.c,v 1.112.2.3.8.8 2006/01/04 23:50:20 marka Exp $
+ * $Id: tsig.c,v 1.112.2.3.8.9 2006/03/08 03:55:54 marka Exp $
  */
 
 #include <config.h>
@@ -560,7 +560,7 @@ dns_tsig_sign(dns_message_t *msg) {
                goto cleanup_signature;
        ret = isc_buffer_allocate(msg->mctx, &dynbuf, 512);
        if (ret != ISC_R_SUCCESS)
-               goto cleanup_signature;
+               goto cleanup_rdata;
        ret = dns_rdata_fromstruct(rdata, dns_rdataclass_any,
                                   dns_rdatatype_tsig, &tsig, dynbuf);
        if (ret != ISC_R_SUCCESS)
@@ -576,7 +576,7 @@ dns_tsig_sign(dns_message_t *msg) {
        owner = NULL;
        ret = dns_message_gettempname(msg, &owner);
        if (ret != ISC_R_SUCCESS)
-               goto cleanup_context;
+               goto cleanup_rdata;
        dns_name_init(owner, NULL);
        ret = dns_name_dup(&key->name, msg->mctx, owner);
        if (ret != ISC_R_SUCCESS)
@@ -608,18 +608,17 @@ dns_tsig_sign(dns_message_t *msg) {
        dns_message_puttemprdatalist(msg, &datalist);
  cleanup_owner:
        dns_message_puttempname(msg, &owner);
-       goto cleanup_context;
-
+       goto cleanup_rdata;
  cleanup_dynbuf:
        isc_buffer_free(&dynbuf);
+ cleanup_rdata:
+       dns_message_puttemprdata(msg, &rdata);
  cleanup_signature:
        if (tsig.signature != NULL)
                isc_mem_put(mctx, tsig.signature, sigsize);
-
  cleanup_context:
-       if (rdata != NULL)
-               dns_message_puttemprdata(msg, &rdata);
-       dst_context_destroy(&ctx);
+       if (ctx != NULL)
+               dst_context_destroy(&ctx);
        return (ret);
 }