dns_view_untrust modifies dnskey->flags when it shouldn't

Copy the structure and declare dnskey as const.

(cherry picked from commit 21d828241b47c1fbdc6083c20b21dd95f48acc87)

diff --git a/lib/dns/include/dns/view.h b/lib/dns/include/dns/view.h
index c844e1c69510b1dfc1d626e49fc858ee67856e54..d6e7f10e1893395001e93c3494c16257b89465f6 100644 (file)
--- a/lib/dns/include/dns/view.h
+++ b/lib/dns/include/dns/view.h
@@ -1197,7 +1197,7 @@ dns_view_ntacovers(dns_view_t *view, isc_stdtime_t now, const dns_name_t *name,
 
 void
 dns_view_untrust(dns_view_t *view, const dns_name_t *keyname,
-                dns_rdata_dnskey_t *dnskey);
+                const dns_rdata_dnskey_t *dnskey);
 /*%<
  * Remove keys that match 'keyname' and 'dnskey' from the views trust
  * anchors.

diff --git a/lib/dns/view.c b/lib/dns/view.c
index 47822a43836ae0df38a8c411d14db1e89788ae8c..a67dd73a3ca73366fcdc7cc6537d518a14de3d73 100644 (file)
--- a/lib/dns/view.c
+++ b/lib/dns/view.c
@@ -1992,26 +1992,28 @@ dns_view_issecuredomain(dns_view_t *view, const dns_name_t *name,
 
 void
 dns_view_untrust(dns_view_t *view, const dns_name_t *keyname,
-                dns_rdata_dnskey_t *dnskey) {
+                const dns_rdata_dnskey_t *dnskey) {
        isc_result_t result;
        dns_keytable_t *sr = NULL;
+       dns_rdata_dnskey_t tmpkey;
 
        REQUIRE(DNS_VIEW_VALID(view));
        REQUIRE(keyname != NULL);
        REQUIRE(dnskey != NULL);
 
-       /*
-        * Clear the revoke bit, if set, so that the key will match what's
-        * in secroots now.
-        */
-       dnskey->flags &= ~DNS_KEYFLAG_REVOKE;
-
        result = dns_view_getsecroots(view, &sr);
        if (result != ISC_R_SUCCESS) {
                return;
        }
 
-       result = dns_keytable_deletekey(sr, keyname, dnskey);
+       /*
+        * Clear the revoke bit, if set, so that the key will match what's
+        * in secroots now.
+        */
+       tmpkey = *dnskey;
+       tmpkey.flags &= ~DNS_KEYFLAG_REVOKE;
+
+       result = dns_keytable_deletekey(sr, keyname, &tmpkey);
        if (result == ISC_R_SUCCESS) {
                /*
                 * If key was found in secroots, then it was a