1604. [bug] A xfrout_ctx_create() failure would result in

                        xfrout_ctx_destroy() being called with a
                        partially initialized structure.

diff --git a/CHANGES b/CHANGES
index eb45c02fa80b8e1927379cb1966d790b92b23b2b..511e5e55db046a6e67a3d4e725e823fb6f582e4d 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+1604.  [bug]           A xfrout_ctx_create() failure would result in
+                       xfrout_ctx_destroy() being called with a
+                       partially initialized structure.
+                       
 1455.   [bug]           <netaddr> missing from server grammar in
                         doc/misc/options. [RT #5616]
 

diff --git a/bin/named/xfrout.c b/bin/named/xfrout.c
index 3b80d9bbb0f51148405d60a341b546f290a535c6..76a113ac2d41c85820fcd2eb8f1758527fe5f7db 100644 (file)
--- a/bin/named/xfrout.c
+++ b/bin/named/xfrout.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: xfrout.c,v 1.101.2.6 2004/03/09 06:09:20 marka Exp $ */
+/* $Id: xfrout.c,v 1.101.2.7 2004/04/06 00:27:29 marka Exp $ */
 
 #include <config.h>
 
@@ -1139,8 +1139,6 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
                                        ISC_TRUE : ISC_FALSE,
                                &xfr));
        stream = NULL;
-       db = NULL;
-       ver = NULL;
        quota = NULL;
 
        CHECK(xfr->stream->methods->first(xfr->stream));
@@ -1216,10 +1214,10 @@ xfrout_ctx_create(isc_mem_t *mctx, ns_client_t *client, unsigned int id,
        xfr->qname = qname;
        xfr->qtype = qtype;
        xfr->qclass = qclass;
-       xfr->db = db;
-       xfr->ver = ver;
-       xfr->quota = quota;
-       xfr->stream = stream;
+       xfr->db = NULL;
+       xfr->ver = NULL;
+       dns_db_attach(db, &xfr->db);
+       dns_db_attachversion(db, ver, &xfr->ver);
        xfr->end_of_stream = ISC_FALSE;
        xfr->tsigkey = tsigkey;
        xfr->lasttsig = lasttsig;
@@ -1229,6 +1227,12 @@ xfrout_ctx_create(isc_mem_t *mctx, ns_client_t *client, unsigned int id,
        xfr->many_answers = many_answers,
        xfr->sends = 0;
        xfr->shuttingdown = ISC_FALSE;
+       xfr->buf.base = NULL;
+       xfr->buf.length = 0;
+       xfr->txmem = NULL;
+       xfr->txmemlen = 0;
+       xfr->stream = NULL;
+       xfr->quota = NULL;
 
        /*
         * Allocate a temporary buffer for the uncompressed response
@@ -1273,6 +1277,12 @@ xfrout_ctx_create(isc_mem_t *mctx, ns_client_t *client, unsigned int id,
         */
        xfr->client->shutdown = xfrout_client_shutdown;
        xfr->client->shutdown_arg = xfr;
+       /*
+        * These MUST be after the last "goto failure;" / CHECK to
+        * prevent a double free by the caller.
+        */
+       xfr->quota = quota;
+       xfr->stream = stream;
 
        *xfrp = xfr;
        return (ISC_R_SUCCESS);