[master] fix use after free on xfr timeout

4289.	[bug]		The server could crash due to memory being used
			after it was freed if a zone transfer timed out.
			[RT #41297]

diff --git a/CHANGES b/CHANGES
index 1cf1596d549f0eead1d3441cc3dd5c1759234c44..819ccb008b543c457bbefd6071c6840b5ccd2cd7 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+4289.  [bug]           The server could crash due to memory being used
+                       after it was freed if a zone transfer timed out.
+                       [RT #41297]
+
 4288.  [bug]           Fixed a regression in resolver.c:possibly_mark()
                        which caused known-bogus servers to be queried
                        anyway. [RT #41321]

diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
index dd39b47d474ef52b7bf4a2a77648376e3868328f..1d042634eaad5ec2f86d1488d4612ca66abc9c29 100644 (file)
--- a/doc/arm/notes.xml
+++ b/doc/arm/notes.xml
@@ -759,6 +759,12 @@
   </section>
   <section xml:id="relnotes_bugs"><info><title>Bug Fixes</title></info>
     <itemizedlist>
+      <listitem>
+       <para>
+         The server could crash due to a use-after-free if a
+         zone transfer timed out. [RT #41297]
+       </para>
+      </listitem>
       <listitem>
        <para>
          Authoritative servers that were marked as bogus (e.g. blackholed

diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
index e5faf921c5af53f622a427d940e1330b4c1c6f53..5546104a29232bcb78718919c90ccac743aa04bd 100644 (file)
--- a/lib/dns/dst_api.c
+++ b/lib/dns/dst_api.c
@@ -346,8 +346,9 @@ dst_context_create4(dst_key_t *key, isc_mem_t *mctx,
        dctx = isc_mem_get(mctx, sizeof(dst_context_t));
        if (dctx == NULL)
                return (ISC_R_NOMEMORY);
-       dctx->key = key;
-       dctx->mctx = mctx;
+       memset(dctx, 0, sizeof(*dctx));
+       dst_key_attach(key, &dctx->key);
+       isc_mem_attach(mctx, &dctx->mctx);
        dctx->category = category;
        if (useforsigning)
                dctx->use = DO_SIGN;
@@ -358,7 +359,9 @@ dst_context_create4(dst_key_t *key, isc_mem_t *mctx,
        else
                result = key->func->createctx(key, dctx);
        if (result != ISC_R_SUCCESS) {
-               isc_mem_put(mctx, dctx, sizeof(dst_context_t));
+               if (dctx->key != NULL)
+                       dst_key_free(&dctx->key);
+               isc_mem_putanddetach(&dctx->mctx, dctx, sizeof(dst_context_t));
                return (result);
        }
        dctx->magic = CTX_MAGIC;
@@ -375,8 +378,10 @@ dst_context_destroy(dst_context_t **dctxp) {
        dctx = *dctxp;
        INSIST(dctx->key->func->destroyctx != NULL);
        dctx->key->func->destroyctx(dctx);
+       if (dctx->key != NULL)
+               dst_key_free(&dctx->key);
        dctx->magic = 0;
-       isc_mem_put(dctx->mctx, dctx, sizeof(dst_context_t));
+       isc_mem_putanddetach(&dctx->mctx, dctx, sizeof(dst_context_t));
        *dctxp = NULL;
 }