3280. [bug] Potential double free of a rdataset on out of memory

                        with DNS64. [RT #27762]

diff --git a/CHANGES b/CHANGES
index 8d329e6c28cbaac75d5462bd4b282023225d06ae..0f3049c337548a775ec5d997e5f5bb45a27f1448 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3280.  [bug]           Potential double free of a rdataset on out of memory
+                       with DNS64. [RT #27762]
+
 3279.  [bug]           Hold a internal reference to the zone while performing
                        a asynchronous load.  Address potential memory leak
                        if the asynchronous is cancelled. [RT #27750]

diff --git a/bin/named/query.c b/bin/named/query.c
index 9f6c86e694c2a1cdff50e5a8090d15a2a3cfa889..dd0558b96de80cd51751b6826d3e184b1d271878 100644 (file)
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: query.c,v 1.381 2012/01/07 00:19:59 each Exp $ */
+/* $Id: query.c,v 1.381.16.1 2012/02/07 01:09:42 marka Exp $ */
 
 /*! \file */
 
@@ -6114,6 +6114,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
                                query_putrdataset(client, &sigrdataset);
                        rdataset = client->query.dns64_aaaa;
                        sigrdataset = client->query.dns64_sigaaaa;
+                       client->query.dns64_aaaa = NULL;
+                       client->query.dns64_sigaaaa = NULL;
                        if (fname == NULL) {
                                dbuf = query_getnamebuf(client);
                                if (dbuf == NULL) {
@@ -6127,8 +6129,6 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
                                }
                        }
                        dns_name_copy(client->query.qname, fname, NULL);
-                       client->query.dns64_aaaa = NULL;
-                       client->query.dns64_sigaaaa = NULL;
                        dns64 = ISC_FALSE;
 #ifdef dns64_bis_return_excluded_addresses
                        /*
@@ -6373,6 +6373,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
                                query_putrdataset(client, &sigrdataset);
                        rdataset = client->query.dns64_aaaa;
                        sigrdataset = client->query.dns64_sigaaaa;
+                       client->query.dns64_aaaa = NULL;
+                       client->query.dns64_sigaaaa = NULL;
                        if (fname == NULL) {
                                dbuf = query_getnamebuf(client);
                                if (dbuf == NULL) {
@@ -6386,8 +6388,6 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
                                }
                        }
                        dns_name_copy(client->query.qname, fname, NULL);
-                       client->query.dns64_aaaa = NULL;
-                       client->query.dns64_sigaaaa = NULL;
                        dns64 = ISC_FALSE;
 #ifdef dns64_bis_return_excluded_addresses
                        if (dns64_excluded)