[master] use after free in resquery_destroy()

4102.	[bug]		Fix a use after free bug introduced in change
			#4094.  [RT #39281]

diff --git a/CHANGES b/CHANGES
index dd0e4f22de1d27478dc1de3f1d65423b57705206..dc9bd37e3556b76b60a729b35c4700c656fe0c4f 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4102.  [bug]           Fix a use after free bug introduced in change
+                       #4094.  [RT #39281]
+
 4101.  [bug]           dig: the +split and +rrcomments options didn't
                        work with +short. [RT #39291]
 

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 3318b61b739afeea18436fe6350ce39330e9c35b..821d53dd71548323b9e043946b20fa803afc4915 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -823,6 +823,7 @@ resquery_destroy(resquery_t **queryp) {
        isc_boolean_t empty;
        resquery_t *query;
        fetchctx_t *fctx;
+       unsigned int bucket;
 
        REQUIRE(queryp != NULL);
        query = *queryp;
@@ -832,12 +833,13 @@ resquery_destroy(resquery_t **queryp) {
 
        fctx = query->fctx;
        res = fctx->res;
+       bucket = fctx->bucketnum;
 
        fctx->nqueries--;
 
-       LOCK(&res->buckets[fctx->bucketnum].lock);
+       LOCK(&res->buckets[bucket].lock);
        empty = fctx_decreference(query->fctx);
-       UNLOCK(&res->buckets[fctx->bucketnum].lock);
+       UNLOCK(&res->buckets[bucket].lock);
 
        query->magic = 0;
        isc_mem_put(query->mctx, query, sizeof(*query));