fix bad-cache assert

3346.	[security]	Bad-cache data could be used before it was
			initialized, causing an assert. [RT #30025]

diff --git a/CHANGES b/CHANGES
index 3caa37ffd4fc5579b7743cbb5dbd0308bbab0074..a291c8e03d87f028457f244c280362f3792d05e3 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3346.  [security]      Bad-cache data could be used before it was
+                       initialized, causing an assert. [RT #30025]
+
 3345.  [bug]           Addressed race condition when removing the last item
                        or inserting the first item in an ISC_QUEUE.
                        [RT #29539]

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index f6ce93bdd4b613cf80c47ead83ff9addf669156a..d81de760e171b1a14dfff1c0b4e249f71c6085e4 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -8452,6 +8452,7 @@ dns_resolver_addbadcache(dns_resolver_t *resolver, dns_name_t *name,
                        goto cleanup;
                bad->type = type;
                bad->hashval = hashval;
+               bad->expire = *expire;
                isc_buffer_init(&buffer, bad + 1, name->length);
                dns_name_init(&bad->name, NULL);
                dns_name_copy(name, &bad->name, &buffer);
@@ -8463,8 +8464,8 @@ dns_resolver_addbadcache(dns_resolver_t *resolver, dns_name_t *name,
                if (resolver->badcount < resolver->badhash * 2 &&
                    resolver->badhash > DNS_BADCACHE_SIZE)
                        resizehash(resolver, &now, ISC_FALSE);
-       }
-       bad->expire = *expire;
+       } else
+               bad->expire = *expire;
  cleanup:
        UNLOCK(&resolver->lock);
 }