pullup:

 351.   [bug]           Constructing a response with rcode SERVFAIL to a TSIG
                        signed query could crash the server.

diff --git a/CHANGES b/CHANGES
index 5a6e5aa2e26c05eb01df32d5c8718ec8d993510f..4477fc4ea762f429cf89b71a78e81fe4f2df7117 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,7 @@
 
+ 351.  [bug]           Constructing a response with rcode SERVFAIL to a TSIG
+                       signed query could crash the server.
+
  350.  [bug]           Also-notify lists specified in the global options
                        block were not correctly reference counted, causing
                        a memory leak.

diff --git a/lib/dns/message.c b/lib/dns/message.c
index 4cb3f9560eb19d5439af8131ad46c8dfe6671ea0..75eac4ec488cbc00504064faae18c2e20bbbd446 100644 (file)
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: message.c,v 1.131.2.2 2000/07/03 17:20:43 gson Exp $ */
+/* $Id: message.c,v 1.131.2.3 2000/07/25 23:51:16 gson Exp $ */
 
 /***
  *** Imports
@@ -440,9 +440,10 @@ msgresetsigs(dns_message_t *msg, isc_boolean_t replying) {
                isc_mempool_put(msg->namepool, msg->tsigname);
                msg->tsig = NULL;
                msg->tsigname = NULL;
-       } else if (msg->querytsig != NULL) {
+       } else if (msg->querytsig != NULL && !replying) {
                dns_rdataset_disassociate(msg->querytsig);
                isc_mempool_put(msg->rdspool, msg->querytsig);
+               msg->querytsig = NULL;
        }
        if (msg->sig0 != NULL) {
                INSIST(dns_rdataset_isassociated(msg->sig0));