351. [bug] Constructing a response with rcode SERVFAIL to a TSIG

                        signed query could crash the server.

diff --git a/CHANGES b/CHANGES
index e280bf902e3c362521f4ebc96dabb81ffd0d218d..5aae798ccd3de37597844b3a8c7d5b67e020dd14 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,8 @@
 
+ 351.  [bug]           Constructing a response with rcode SERVFAIL to a TSIG
+                       signed query could crash the server.
+
+                       block were not correctly reference counted, causing
  350.  [bug]           Also-notify lists specified in the global options
                        block were not correctly reference counted, causing
                        a memory leak.

diff --git a/lib/dns/message.c b/lib/dns/message.c
index 1123b71e1ff9dfe4965aff1a1645f73567e7becd..2639c8f2166050717a6e18ceecfa46d8c072f845 100644 (file)
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: message.c,v 1.135 2000/07/20 00:05:32 gson Exp $ */
+/* $Id: message.c,v 1.136 2000/07/25 22:51:45 bwelling Exp $ */
 
 /***
  *** Imports
@@ -442,9 +442,10 @@ msgresetsigs(dns_message_t *msg, isc_boolean_t replying) {
                isc_mempool_put(msg->namepool, msg->tsigname);
                msg->tsig = NULL;
                msg->tsigname = NULL;
-       } else if (msg->querytsig != NULL) {
+       } else if (msg->querytsig != NULL && !replying) {
                dns_rdataset_disassociate(msg->querytsig);
                isc_mempool_put(msg->rdspool, msg->querytsig);
+               msg->querytsig = NULL;
        }
        if (msg->sig0 != NULL) {
                INSIST(dns_rdataset_isassociated(msg->sig0));