3280. [bug] Potential double free of a rdataset on out of memory

                        with DNS64. [RT #27762]

diff --git a/CHANGES b/CHANGES
index 5b4432602dec20fa627263e460ff3b25e2ea865f..1d6fee59d3b560e9b35df0ee5f8e9a47cc1ae6e5 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3280.  [bug]           Potential double free of a rdataset on out of memory
+                       with DNS64. [RT #27762]
+
 3279.  [bug]           Hold a internal reference to the zone while performing
                        a asynchronous load.  Address potential memory leak
                        if the asynchronous is cancelled. [RT #27750]

diff --git a/bin/named/query.c b/bin/named/query.c
index 53aa489b5dfe989a7f2696f1b5c5aff4e73a3776..6bae511641f50ea88d21e5e5187fada5d591bdbf 100644 (file)
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: query.c,v 1.383 2012/01/31 23:47:31 tbox Exp $ */
+/* $Id: query.c,v 1.384 2012/02/07 01:07:47 marka Exp $ */
 
 /*! \file */
 
@@ -6132,6 +6132,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
                                query_putrdataset(client, &sigrdataset);
                        rdataset = client->query.dns64_aaaa;
                        sigrdataset = client->query.dns64_sigaaaa;
+                       client->query.dns64_aaaa = NULL;
+                       client->query.dns64_sigaaaa = NULL;
                        if (fname == NULL) {
                                dbuf = query_getnamebuf(client);
                                if (dbuf == NULL) {
@@ -6145,8 +6147,6 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
                                }
                        }
                        dns_name_copy(client->query.qname, fname, NULL);
-                       client->query.dns64_aaaa = NULL;
-                       client->query.dns64_sigaaaa = NULL;
                        dns64 = ISC_FALSE;
 #ifdef dns64_bis_return_excluded_addresses
                        /*
@@ -6391,6 +6391,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
                                query_putrdataset(client, &sigrdataset);
                        rdataset = client->query.dns64_aaaa;
                        sigrdataset = client->query.dns64_sigaaaa;
+                       client->query.dns64_aaaa = NULL;
+                       client->query.dns64_sigaaaa = NULL;
                        if (fname == NULL) {
                                dbuf = query_getnamebuf(client);
                                if (dbuf == NULL) {
@@ -6404,8 +6406,6 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
                                }
                        }
                        dns_name_copy(client->query.qname, fname, NULL);
-                       client->query.dns64_aaaa = NULL;
-                       client->query.dns64_sigaaaa = NULL;
                        dns64 = ISC_FALSE;
 #ifdef dns64_bis_return_excluded_addresses
                        if (dns64_excluded)