2591. [bug] named could die when processing a update in

                        removed_orphaned_ds(). [RT #19507]

diff --git a/CHANGES b/CHANGES
index e1fc16dc030c5ba3af5e3b42060dd05bb87800b8..20fe5127b5f144ee465938007199630a7bb6c8be 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+2591.  [bug]           named could die when processing a update in
+                       removed_orphaned_ds(). [RT #19507]
+
 2588.  [bug]           SO_REUSEADDR could be set unconditionally after failure
                        of bind(2) call.  This should be rare and mostly
                        harmless, but may cause interference with other

diff --git a/bin/named/update.c b/bin/named/update.c
index 98395bfd848befc8b17cbbf6a35a2d76455d8dda..ff07311617c548e7d0d6aa56914d15d21e2e4e2a 100644 (file)
--- a/bin/named/update.c
+++ b/bin/named/update.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: update.c,v 1.151.12.4 2009/01/29 22:40:33 jinmei Exp $ */
+/* $Id: update.c,v 1.151.12.5 2009/04/30 07:03:37 marka Exp $ */
 
 #include <config.h>
 
@@ -2773,26 +2773,36 @@ static isc_result_t
 remove_orphaned_ds(dns_db_t *db, dns_dbversion_t *newver, dns_diff_t *diff) {
        isc_result_t result;
        isc_boolean_t ns_exists;
-       dns_difftuple_t *t;
+       dns_difftuple_t *tupple;
+       dns_diff_t temp_diff;
 
-       for (t = ISC_LIST_HEAD(diff->tuples);
-            t != NULL;
-            t = ISC_LIST_NEXT(t, link)) {
-               if (!((t->op == DNS_DIFFOP_DEL &&
-                      t->rdata.type == dns_rdatatype_ns) ||
-                     (t->op == DNS_DIFFOP_ADD &&
-                      t->rdata.type == dns_rdatatype_ds)))
+       dns_diff_init(diff->mctx, &temp_diff);
+
+       for (tupple = ISC_LIST_HEAD(diff->tuples);
+            tupple != NULL;
+            tupple = ISC_LIST_NEXT(tupple, link)) {
+               if (!((tupple->op == DNS_DIFFOP_DEL &&
+                      tupple->rdata.type == dns_rdatatype_ns) ||
+                     (tupple->op == DNS_DIFFOP_ADD &&
+                      tupple->rdata.type == dns_rdatatype_ds)))
                        continue;
-               CHECK(rrset_exists(db, newver, &t->name, dns_rdatatype_ns, 0,
-                                  &ns_exists));
-               if (ns_exists && !dns_name_equal(&t->name, dns_db_origin(db)))
+               CHECK(rrset_exists(db, newver, &tupple->name,
+                                  dns_rdatatype_ns, 0, &ns_exists));
+               if (ns_exists &&
+                   !dns_name_equal(&tupple->name, dns_db_origin(db)))
                        continue;
-               CHECK(delete_if(true_p, db, newver, &t->name,
-                               dns_rdatatype_ds, 0, NULL, diff));
+               CHECK(delete_if(true_p, db, newver, &tupple->name,
+                               dns_rdatatype_ds, 0, NULL, &temp_diff));
        }
-       return (ISC_R_SUCCESS);
+       result = ISC_R_SUCCESS;
 
  failure:
+       for (tupple = ISC_LIST_HEAD(temp_diff.tuples);
+            tupple != NULL;
+            tupple = ISC_LIST_HEAD(temp_diff.tuples)) {
+               ISC_LIST_UNLINK(temp_diff.tuples, tupple, link);
+               dns_diff_appendminimal(diff, &tupple);
+       }
        return (result);
 }