Address unchecked returns leading to NULL pointer dereferences

on out of memory conditions.

diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
index 4993265f58173c3f865482554673b10137b8a513..2920a65d213218baf6042456e2d7ff2610bd959b 100644 (file)
--- a/bin/nsupdate/nsupdate.c
+++ b/bin/nsupdate/nsupdate.c
@@ -2747,9 +2747,11 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 #ifdef GSSAPI
        if (usegsstsig) {
                dns_name_init(&tmpzonename, NULL);
-               dns_name_dup(zname, gmctx, &tmpzonename);
+               result = dns_name_dup(zname, gmctx, &tmpzonename);
+               check_result(result, "dns_name_dup");
                dns_name_init(&restart_master, NULL);
-               dns_name_dup(&master, gmctx, &restart_master);
+               result = dns_name_dup(&master, gmctx, &restart_master);
+               check_result(result, "dns_name_dup");
                start_gssrequest(&master);
        } else {
                send_update(zname, &master_servers[master_inuse]);

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index f09805f322954c8afb2dcb8cf4cc749b5f340682..a895b254342180f38c4f5c3d24735785854b4685 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -10062,12 +10062,19 @@ zone_refreshkeys(dns_zone_t *zone) {
                        goto failure;
                }
 
+               kname = dns_fixedname_initname(&kfetch->name);
+               result = dns_name_dup(name, zone->mctx, kname);
+               if (result != ISC_R_SUCCESS) {
+                       isc_mem_put(zone->mctx, kfetch, sizeof(dns_keyfetch_t));
+                       fetch_err = true;
+                       goto failure;
+               }
+
                zone->refreshkeycount++;
                kfetch->zone = zone;
                zone->irefs++;
                INSIST(zone->irefs != 0);
-               kname = dns_fixedname_initname(&kfetch->name);
-               dns_name_dup(name, zone->mctx, kname);
+
                dns_rdataset_init(&kfetch->dnskeyset);
                dns_rdataset_init(&kfetch->dnskeysigset);
                dns_rdataset_init(&kfetch->keydataset);
@@ -11659,7 +11666,10 @@ create_query(dns_zone_t *zone, dns_rdatatype_t rdtype, dns_name_t *name,
        dns_rdataset_t *qrdataset = NULL;
        isc_result_t result;
 
-       dns_message_create(zone->mctx, DNS_MESSAGE_INTENTRENDER, &message);
+       result = dns_message_create(zone->mctx, DNS_MESSAGE_INTENTRENDER, &message);
+       if (result != ISC_R_SUCCESS) {
+               return (result);
+       }
 
        message->opcode = dns_opcode_query;
        message->rdclass = zone->rdclass;
@@ -11833,7 +11843,14 @@ stub_glue_response_cb(isc_task_t *task, isc_event_t *event) {
                goto cleanup;
        }
 
-       dns_message_create(zone->mctx, DNS_MESSAGE_INTENTPARSE, &msg);
+       result = dns_message_create(zone->mctx, DNS_MESSAGE_INTENTPARSE, &msg);
+       if (result != ISC_R_SUCCESS) {
+               dns_zone_log(zone, ISC_LOG_INFO,
+                            "refreshing stub: unable to create message: (%s)",
+                            isc_result_totext(result));
+               goto cleanup;
+       }
+
        result = dns_request_getresponse(revent->request, msg, 0);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_INFO,
@@ -11989,15 +12006,29 @@ stub_request_nameserver_address(struct stub_cb_args *args, bool ipv4,
 
        zone = args->stub->zone;
        request = isc_mem_get(zone->mctx, sizeof(*request));
+       if (request == NULL) {
+               return (ISC_R_NOMEMORY);
+       }
        request->request = NULL;
        request->args = args;
        request->name = (dns_name_t)DNS_NAME_INITEMPTY;
        request->ipv4 = ipv4;
-       dns_name_dup(name, zone->mctx, &request->name);
 
+       result = dns_name_dup(name, zone->mctx, &request->name);
+       if (result != ISC_R_SUCCESS) {
+               zone_debuglog(zone, "stub_send_query", 1,
+                             "dns_name_dup() failed: %s",
+                             dns_result_totext(result));
+                       goto fail;
+       }
        result = create_query(zone, ipv4 ? dns_rdatatype_a : dns_rdatatype_aaaa,
                              &request->name, &message);
-       INSIST(result == ISC_R_SUCCESS);
+       if (result != ISC_R_SUCCESS) {
+               zone_debuglog(zone, "stub_send_query", 1,
+                             "create_query() failed: %s",
+                             dns_result_totext(result));
+                       goto fail;
+       }
 
        if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NOEDNS)) {
                result = add_opt(message, args->udpsize, args->reqnsid, false);
@@ -12018,7 +12049,8 @@ stub_request_nameserver_address(struct stub_cb_args *args, bool ipv4,
                stub_glue_response_cb, request, &request->request);
 
        if (result != ISC_R_SUCCESS) {
-               isc_refcount_decrement(&args->stub->pending_requests, &pending_requests);
+               isc_refcount_decrement(&args->stub->pending_requests,
+                                      &pending_requests);
                INSIST(pending_requests > 0);
                zone_debuglog(zone, "stub_send_query", 1,
                              "dns_request_createvia() failed: %s",
@@ -12031,7 +12063,9 @@ stub_request_nameserver_address(struct stub_cb_args *args, bool ipv4,
        return (ISC_R_SUCCESS);
 
 fail:
-       dns_name_free(&request->name, zone->mctx);
+       if (dns_name_dynamic(&request->name)) {
+               dns_name_free(&request->name, zone->mctx);
+       }
        isc_mem_put(zone->mctx, request, sizeof(*request));
 
        if (message != NULL) {
@@ -12138,8 +12172,16 @@ save_nsrrset(dns_message_t *message, dns_name_t *name,
                        dns_name_t *tmp_name;
                        tmp_name = isc_mem_get(cb_args->stub->mctx,
                                               sizeof(*tmp_name));
+                       if (tmp_name == NULL) {
+                               result = ISC_R_NOMEMORY;
+                               goto done;
+                       }
                        dns_name_init(tmp_name, NULL);
-                       dns_name_dup(&ns.name, cb_args->stub->mctx, tmp_name);
+                       result = dns_name_dup(&ns.name, cb_args->stub->mctx,
+                                             tmp_name);
+                       if (result != ISC_R_SUCCESS) {
+                               goto done;
+                       }
                        ISC_LIST_APPEND(ns_list, tmp_name, link);
                }
        }