2038. [bug] dig/nslookup/host was unlinking from wrong list

                        when handling errors. [RT #16122]

diff --git a/CHANGES b/CHANGES
index 70791bb56100ac01f726dd6e25d69e26979e62c0..03bbb677becb09c8b5d5b12c3a08a8166edf69a3 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+2038.  [bug]           dig/nslookup/host was unlinking from wrong list
+                       when handling errors. [RT #16122]
+
 2037.  [func]          When unlinking the first or last element in a list
                        check that the list head points to the element to
                        be unlinked. [RT #15959]

diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 6129fedb6c64c471c4363d762f12bf1bec79aadc..338317ae8264674c93fc165f60147bac0f5a6071 100644 (file)
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dighost.c,v 1.221.2.19.2.31 2005/10/14 01:38:40 marka Exp $ */
+/* $Id: dighost.c,v 1.221.2.19.2.32 2006/06/06 00:58:50 marka Exp $ */
 
 /*
  * Notice to programmers:  Do not use this code as an example of how to
@@ -1865,12 +1865,20 @@ setup_lookup(dig_lookup_t *lookup) {
  */
 static void
 send_done(isc_task_t *_task, isc_event_t *event) {
+       isc_socketevent_t *sevent = (isc_socketevent_t *)event;
+       isc_buffer_t *b = NULL;
+
        REQUIRE(event->ev_type == ISC_SOCKEVENT_SENDDONE);
 
        UNUSED(_task);
 
        LOCK_LOOKUP;
 
+       for  (b = ISC_LIST_HEAD(sevent->bufferlist);
+             b != NULL;
+             b = ISC_LIST_HEAD(sevent->bufferlist)) 
+               ISC_LIST_DEQUEUE(sevent->bufferlist, b, link);
+
        isc_event_free(&event);
 
        debug("send_done()");
@@ -2171,6 +2179,10 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) {
        recvcount--;
        INSIST(recvcount >= 0);
 
+       b = ISC_LIST_HEAD(sevent->bufferlist);
+       INSIST(b ==  &query->lengthbuf);
+       ISC_LIST_DEQUEUE(sevent->bufferlist, b, link);
+
        if (sevent->result == ISC_R_CANCELED) {
                isc_event_free(&event);
                l = query->lookup;
@@ -2196,8 +2208,6 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) {
                UNLOCK_LOOKUP;
                return;
        }
-       b = ISC_LIST_HEAD(sevent->bufferlist);
-       ISC_LIST_DEQUEUE(sevent->bufferlist, &query->lengthbuf, link);
        length = isc_buffer_getuint16(b);
        if (length == 0) {
                isc_event_free(&event);
@@ -2558,6 +2568,10 @@ recv_done(isc_task_t *task, isc_event_t *event) {
        REQUIRE(event->ev_type == ISC_SOCKEVENT_RECVDONE);
        sevent = (isc_socketevent_t *)event;
 
+       b = ISC_LIST_HEAD(sevent->bufferlist);
+       INSIST(b == &query->recvbuf);
+       ISC_LIST_DEQUEUE(sevent->bufferlist, &query->recvbuf, link);
+
        if ((l->tcp_mode) && (l->timer != NULL))
                isc_timer_touch(l->timer);
        if ((!l->pending && !l->ns_search_only) || cancel_now) {
@@ -2591,9 +2605,6 @@ recv_done(isc_task_t *task, isc_event_t *event) {
                return;
        }
 
-       b = ISC_LIST_HEAD(sevent->bufferlist);
-       ISC_LIST_DEQUEUE(sevent->bufferlist, &query->recvbuf, link);
-
        if (!l->tcp_mode &&
            !isc_sockaddr_equal(&sevent->address, &query->sockaddr)) {
                char buf1[ISC_SOCKADDR_FORMATSIZE];