743. [bug] Receiving a large number of certain malformed

                        answers could cause named to stop responding.

diff --git a/CHANGES b/CHANGES
index 8548ff321f70390898e0816cd171f5853a335d19..b234509cb95dbe4b8dff3eeb310e6538d00988b4 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+
+ 743.  [bug]           Receiving a large number of certain malformed
+                       answers could cause named to stop responding.
+
  742.  [bug]           dig +domain did not work. [RT #850]
 
  738.  [bug]           If a non-threadsafe sdb driver supported AXFR and

diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
index fd5e5b5a40d260100237eefa1d3f197395861860..5608fa7cff70cfef736e35d33945a3f78b47dde9 100644 (file)
--- a/lib/dns/dispatch.c
+++ b/lib/dns/dispatch.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dispatch.c,v 1.78.2.3 2001/02/07 18:50:37 gson Exp $ */
+/* $Id: dispatch.c,v 1.78.2.4 2001/02/16 21:39:00 gson Exp $ */
 
 #include <config.h>
 
@@ -622,6 +622,10 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) {
        queue_response = ISC_FALSE;
        if ((flags & DNS_MESSAGEFLAG_QR) == 0) {
                resp = ISC_LIST_HEAD(disp->rq_handlers);
+               if (resp == NULL) {
+                       free_buffer(disp, ev->region.base, ev->region.length);
+                       goto restart;
+               }
                while (resp != NULL) {
                        if (resp->item_out == ISC_FALSE)
                                break;
@@ -835,6 +839,8 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) {
                 * Query.
                 */
                resp = ISC_LIST_HEAD(disp->rq_handlers);
+               if (resp == NULL)
+                       goto restart;
                while (resp != NULL) {
                        if (resp->item_out == ISC_FALSE)
                                break;