[v9_8] double free caused assertion in acache

3553.	[bug]		Address suspected double free in acache. [RT #33252]
(cherry picked from commit 11b04b18f8ecb7c0119a7a6b6bbf8f5bad789c9a)
(cherry picked from commit 3673e8535584457ec1a79b6a30ddf4d182b0f921)

diff --git a/CHANGES b/CHANGES
index 5a3f8af9011c7ed0b16ceff5902d252dfa6469dc..ff667d75d32373a4c800310c38b290e38b12087e 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,7 @@
+3553.  [bug]           Address suspected double free in acache. [RT #33252]
+
 3552.  [bug]           Wrong getopt option string for 'nsupdate -r'.
-                       [RT# 33280]
+                       [RT #33280]
 
 3549.  [doc]           Documentation for "request-nsid" was missing.
                        [RT #33153]

diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index d18b6720c3ed97060ad8bcf103e1f9adb0a61b7b..accfa861d5324e33458989191b2c0de507539310 100644 (file)
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -8926,11 +8926,10 @@ acache_callback(dns_acacheentry_t *entry, void **arg) {
        if (acarray != NULL && acarray[count].entry == entry) {
                acarray[count].entry = NULL;
                INSIST(acarray[count].cbarg == cbarg);
-               isc_mem_put(rbtdb->common.mctx, cbarg, sizeof(acache_cbarg_t));
                acarray[count].cbarg = NULL;
-               dns_acache_detachentry(&entry);
-       } else
                isc_mem_put(rbtdb->common.mctx, cbarg, sizeof(acache_cbarg_t));
+               dns_acache_detachentry(&entry);
+       }
 
        NODE_UNLOCK(nodelock, isc_rwlocktype_write);