3425. [bug] "acacheentry" reference counting was broken resulting

                        in use after free. [RT #31908]

diff --git a/CHANGES b/CHANGES
index 0cf816fc94df30463e002712e7237845f469f052..2164138ad39eb1781f5dc5b7fe020d2a01fc7acf 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3425.  [bug]           "acacheentry" reference counting was broken resulting
+                       in use after free. [RT #31908]
+
 3424.  [func]          dnssec-dsfromkey now emits the hash without spaces.
                        [RT #31951]
 

diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index 48ab6003418503b7699d36d79beedd2d49bcc37c..f2ad8c75bc1fbd243e76497dd16ef42ba61afb39 100644 (file)
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -9371,11 +9371,10 @@ acache_callback(dns_acacheentry_t *entry, void **arg) {
                INSIST(acarray[count].cbarg == cbarg);
                isc_mem_put(rbtdb->common.mctx, cbarg, sizeof(acache_cbarg_t));
                acarray[count].cbarg = NULL;
+               dns_acache_detachentry(&entry);
        } else
                isc_mem_put(rbtdb->common.mctx, cbarg, sizeof(acache_cbarg_t));
 
-       dns_acache_detachentry(&entry);
-
        NODE_UNLOCK(nodelock, isc_rwlocktype_write);
 
        dns_db_detachnode((dns_db_t *)rbtdb, (dns_dbnode_t **)(void*)&rbtnode);
@@ -9467,6 +9466,7 @@ rdataset_setadditional(dns_rdataset_t *rdataset, dns_rdatasetadditional_t type,
                                        acache_callback, newcbarg, &newentry);
        if (result != ISC_R_SUCCESS)
                goto fail;
+
        /* Set cache data in the new entry. */
        result = dns_acache_setentry(acache, newentry, zone, db,
                                     version, node, fname);