4410. [bug] Address use after free and memory leak with dnstap.

                        [RT #42746]

diff --git a/CHANGES b/CHANGES
index 979d1043c9b13d099575019284f885b4263e921c..f2f57d7e4e798c863b7ac1a983e0e9c0a97516c0 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4410.  [bug]           Address use after free and memory leak with dnstap.
+                       [RT #42746]
+
 4409.  [bug]           DNS64 should exclude mapped addresses by default when
                        an exclude acl is not defined. [RT #42810]
 

diff --git a/bin/named/client.c b/bin/named/client.c
index 5946fe2e0d49c81bd57a6d6f71810be601eaf9a6..e0c3558d8261aaae42f660986d17385a98d6e3cc 100644 (file)
--- a/bin/named/client.c
+++ b/bin/named/client.c
@@ -1178,10 +1178,6 @@ client_send(ns_client_t *client) {
                isc_buffer_putuint16(&tcpbuffer, (isc_uint16_t) r.length);
                isc_buffer_add(&tcpbuffer, r.length);
 
-               /* don't count the 2-octet length header */
-               respsize = isc_buffer_usedlength(&tcpbuffer) - 2;
-               result = client_sendpkg(client, &tcpbuffer);
-
 #ifdef HAVE_DNSTAP
                if (client->view != NULL) {
                        dns_dt_send(client->view, dtmsgtype,
@@ -1190,6 +1186,9 @@ client_send(ns_client_t *client) {
                }
 #endif /* HAVE_DNSTAP */
 
+               /* don't count the 2-octet length header */
+               respsize = isc_buffer_usedlength(&tcpbuffer) - 2;
+               result = client_sendpkg(client, &tcpbuffer);
 
                switch (isc_sockaddr_pf(&client->peeraddr)) {
                case AF_INET:

diff --git a/lib/dns/dnstap.c b/lib/dns/dnstap.c
index 39d2e562dcb8bdda3af88a8935ffa25d8396c97c..b80fb67cdf9b1e177f6f05ecbf5ff76f6b71c2f1 100644 (file)
--- a/lib/dns/dnstap.c
+++ b/lib/dns/dnstap.c
@@ -242,6 +242,9 @@ dns_dt_create(isc_mem_t *mctx, dns_dtmode_t mode, const char *path,
        if (fopt != NULL)
                fstrm_iothr_options_destroy(&fopt);
 
+       if (ffwopt != NULL)
+               fstrm_file_options_destroy(&ffwopt);
+
        if (fuwopt != NULL)
                fstrm_unix_writer_options_destroy(&fuwopt);
 
@@ -280,8 +283,6 @@ dns_dt_reopen(dns_dtenv_t *env) {
                return (ISC_R_SUCCESS);
        }
 
-
-
        return (result);
 }
 
@@ -641,8 +642,6 @@ dns_dt_send(dns_view_t *view, dns_dtmsgtype_t msgtype,
 
        if (pack_dt(&dm.d, &dm.buf, &dm.len) == ISC_R_SUCCESS)
                send_dt(view->dtenv, dm.buf, dm.len);
-
-       return;
 }
 
 void