4098. [bug] Address use-after-free issue when using a

                        predecessor key with dnssec-settime. [RT #39272]

diff --git a/CHANGES b/CHANGES
index e636214a17f88a6acd796a35163e6d16b417f3a6..2ffdf0ddfea17bf003a6b6e33a3cf265b93e2b2f 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,10 +1,13 @@
+4098.  [bug]           Address use-after-free issue when using a
+                       predecessor key with dnssec-settime. [RT #39272]
+
 4097.  [func]          Add additional logging about xfrin transfer status.
                        [RT #39170]
 
 4096.  [bug]           Fix a use after free of query->sendevent.
                        [RT #39132]
 
-4095.  [bug]           zone->options2 was not being properly initalized.
+4095.  [bug]           zone->options2 was not being properly initialized.
                        [RT #39228]
 
 4094.  [bug]           A race during shutdown or reconfiguration could
@@ -120,7 +123,7 @@
 4061.  [bug]           Handle timeout in legacy system test. [RT #38573]
 
 4060.  [bug]           dns_rdata_freestruct could be called on a
-                       uninitialised structure when handling a error.
+                       uninitialized structure when handling a error.
                        [RT #38568]
 
 4059.  [bug]           Addressed valgrind warnings. [RT #38549]

diff --git a/bin/dnssec/dnssec-settime.c b/bin/dnssec/dnssec-settime.c
index 33593c50366cf0f01cd8406fc857b4f5f3beebc7..8d784a624b59823acabe877c76ce08942b968050 100644 (file)
--- a/bin/dnssec/dnssec-settime.c
+++ b/bin/dnssec/dnssec-settime.c
@@ -409,7 +409,6 @@ main(int argc, char **argv) {
                                        "inactive.\n", program);
 
                changed = setpub = setact = ISC_TRUE;
-               dst_key_free(&prevkey);
        } else {
                if (prepub < 0)
                        prepub = 0;
@@ -600,6 +599,8 @@ main(int argc, char **argv) {
                printf("%s\n", newname);
        }
 
+       if (prevkey != NULL)
+               dst_key_free(&prevkey);
        dst_key_free(&key);
        dst_lib_destroy();
        isc_hash_destroy();