- Fix val_find_DS for robustness, to check the result of

  packet_rrset_copy_region before using it. Thanks to Xin Wang
  and Jiajia Liu, Northwestern Polytechnical University, for
  the report.

diff --git a/doc/Changelog b/doc/Changelog
index 4df945ab5bf0d6423adc655f331d9b514e99ee36..553120166b0480d41dc9c21cafbcd488b7e13eb2 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,5 +1,9 @@
 15 May 2026: Wouter
        - Fix man page entry for so-sndbuf, it is for responses sent out.
+       - Fix val_find_DS for robustness, to check the result of
+         packet_rrset_copy_region before using it. Thanks to Xin Wang
+         and Jiajia Liu, Northwestern Polytechnical University, for
+         the report.
 
 11 May 2026: Yorgos
        - Fix comment and verbose logging for EDNS fallback buffer size.

diff --git a/validator/val_utils.c b/validator/val_utils.c
index 411a63b25c5b53e7ba9aeae90ca486594cccf38b..b94b6fde095b0e434f0389c3917957873822e02f 100644 (file)
--- a/validator/val_utils.c
+++ b/validator/val_utils.c
@@ -1310,10 +1310,11 @@ val_find_DS(struct module_env* env, uint8_t* nm, size_t nmlen, uint16_t c,
                /* DS rrset exists. Return it to the validator immediately*/
                struct ub_packed_rrset_key* copy = packed_rrset_copy_region(
                        rrset, region, *env->now);
-               struct packed_rrset_data* d = copy->entry.data;
+               struct packed_rrset_data* d;
                lock_rw_unlock(&rrset->entry.lock);
                if(!copy)
                        return NULL;
+               d = (struct packed_rrset_data*)copy->entry.data;
                msg = dns_msg_create(nm, nmlen, LDNS_RR_TYPE_DS, c, region, 1);
                if(!msg)
                        return NULL;