1604. [bug] A xfrout_ctx_create() failure would result in

                        xfrout_ctx_destroy() being called with a
                        partially initaliased structure.

diff --git a/CHANGES b/CHANGES
index 07b91cf2ba4fd65a5c894f333df6adc415bc35a1..09911b6175469262fd550ba81a0b73d78ad72417 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+1604.  [bug]           A xfrout_ctx_create() failure would result in
+                       xfrout_ctx_destroy() being called with a
+                       partially initaliased structure.
+                       
 1603.  [placeholder]   rt10929.
 
 1602.  [placeholder]   rt10925.

diff --git a/bin/named/xfrout.c b/bin/named/xfrout.c
index fb2cb2246ee01ca6f4d1e541a8b7482b74a33538..0d260870dcc9e631d1d8fbc50cf9b00354d55bf7 100644 (file)
--- a/bin/named/xfrout.c
+++ b/bin/named/xfrout.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: xfrout.c,v 1.115 2004/03/05 04:57:49 marka Exp $ */
+/* $Id: xfrout.c,v 1.116 2004/04/02 05:13:25 marka Exp $ */
 
 #include <config.h>
 
@@ -1142,8 +1142,6 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
                                &xfr));
        xfr->mnemonic = mnemonic;
        stream = NULL;
-       db = NULL;
-       ver = NULL;
        quota = NULL;
 
        CHECK(xfr->stream->methods->first(xfr->stream));
@@ -1225,10 +1223,10 @@ xfrout_ctx_create(isc_mem_t *mctx, ns_client_t *client, unsigned int id,
        xfr->qname = qname;
        xfr->qtype = qtype;
        xfr->qclass = qclass;
-       xfr->db = db;
-       xfr->ver = ver;
-       xfr->quota = quota;
-       xfr->stream = stream;
+       xfr->db = NULL;
+       xfr->ver = NULL;
+       dns_db_attach(db, &xfr->db);
+       dns_db_attachversion(db, ver, &xfr->ver);
        xfr->end_of_stream = ISC_FALSE;
        xfr->tsigkey = tsigkey;
        xfr->lasttsig = lasttsig;
@@ -1239,6 +1237,12 @@ xfrout_ctx_create(isc_mem_t *mctx, ns_client_t *client, unsigned int id,
        xfr->sends = 0;
        xfr->shuttingdown = ISC_FALSE;
        xfr->mnemonic = NULL;
+       xfr->buf.base = NULL;
+       xfr->buf.length = 0;
+       xfr->txmem = NULL;
+       xfr->txmemlen = 0;
+       xfr->stream = NULL;
+       xfr->quota = NULL;
 
        /*
         * Allocate a temporary buffer for the uncompressed response
@@ -1283,6 +1287,12 @@ xfrout_ctx_create(isc_mem_t *mctx, ns_client_t *client, unsigned int id,
         */
        xfr->client->shutdown = xfrout_client_shutdown;
        xfr->client->shutdown_arg = xfr;
+       /*
+        * These MUST be after the last "goto failure;" / CHECK to
+        * prevent a double free by the caller.
+        */
+       xfr->quota = quota;
+       xfr->stream = stream;
 
        *xfrp = xfr;
        return (ISC_R_SUCCESS);