Fix a dig segfault due to bad linked list usage [RT #37591]

The crash (#37591) seems to happen because the query is taken out of
lookup->q(query->link), and put on lookup->connecting(query->clink).
The code checks query->link where it is detached (-1 in next pointer).
However, there's no need to call send_tcp_connect() there as the queries
are already connecting at that point.

diff --git a/CHANGES b/CHANGES
index f2016cf78218c60fac6ce45dd60d419c6b5c0d3f..d9d7872468f72c7606f354c01906a9b222d67876 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4016.  [bug]           Fix a dig segfault due to bad linked list usage.
+                       [RT #37591]
+
 4015.  [bug]           Nameservers that are skipped due to them being
                        CNAMEs were not being logged. They are now logged
                        to category 'cname' as per BIND 8. [RT #37935]

diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 568e798518fcc8ccc17acd6a767e7089810be345..fc93802831faacaa383e3ce4acf8afb1de45140d 100644 (file)
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -3242,7 +3242,8 @@ connect_done(isc_task_t *task, isc_event_t *event) {
                query->waiting_connect = ISC_FALSE;
                isc_event_free(&event);
                l = query->lookup;
-               if (l->current_query != NULL)
+               if ((l->current_query != NULL) &&
+                   (ISC_LINK_LINKED(l->current_query, link)))
                        next = ISC_LIST_NEXT(l->current_query, link);
                else
                        next = NULL;