Fix use after free when closing an LMDB (#46000)

diff --git a/CHANGES b/CHANGES
index 1b4ca0fe33bcded342c821dcc24315db2822d285..2c1d7f6bf7b5f6a988af34359a6dab2fb1f9781d 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+4781.  [bug]           Fix use after free when closing an LMDB. [RT #46000]
+
 4780.  [bug]           Fix out of bounds access in DHCID totext() method.
                        [RT #46001]
 

diff --git a/bin/named/server.c b/bin/named/server.c
index 162ff90d2d8053fb1519428073d7ba19b042fbcc..eb728cf3509d3803b18a4daa580ef9e2ec3612f5 100644 (file)
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -11833,29 +11833,35 @@ static void
 nzd_env_close(dns_view_t *view) {
        if (view->new_zone_dbenv != NULL) {
                const char *dbpath = NULL;
+               isc_boolean_t have_dbpath = ISC_FALSE;
+               char dbpath_copy[PATH_MAX];
                char lockpath[PATH_MAX];
                int ret;
 
                if (mdb_env_get_path(view->new_zone_dbenv, &dbpath) == 0) {
+                       have_dbpath = ISC_TRUE;
                        snprintf(lockpath, sizeof(lockpath), "%s-lock",
                                 dbpath);
+                       strlcpy(dbpath_copy, dbpath, sizeof(dbpath_copy));
                }
 
                mdb_env_close((MDB_env *) view->new_zone_dbenv);
                view->new_zone_dbenv = NULL;
 
-               /*
-                * Database files must be owned by the eventual user, not
-                * by root.
-                */
-               ret = chown(dbpath, ns_os_uid(), -1);
-               UNUSED(ret);
+               if (have_dbpath) {
+                       /*
+                        * Database files must be owned by the eventual user, not
+                        * by root.
+                        */
+                       ret = chown(dbpath_copy, ns_os_uid(), -1);
+                       UNUSED(ret);
 
-                /*
-                 * Some platforms need the lockfile not to exist when we
-                 * reopen the environment.
-                */
-               (void) isc_file_remove(lockpath);
+                       /*
+                        * Some platforms need the lockfile not to exist when we
+                        * reopen the environment.
+                        */
+                       (void) isc_file_remove(lockpath);
+               }
        }
 }