1525. [bug] dns_cache_create() could dereference a NULL pointer

                        during error cleanup.

diff --git a/CHANGES b/CHANGES
index d7f7f416f8ddfde66868d9530d9af62af873559a..3d50854e6b8b7194689077ea0d97ab75d45a0af6 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+1525.  [bug]           dns_cache_create() could dereference a NULL pointer
+                       during error cleanup.
+
 1524.  [port]          AIX needs to be able to resolve all symbols when
                        creating shared libraries (--with-libtool).
 

diff --git a/lib/dns/cache.c b/lib/dns/cache.c
index d7406ae56c2096a42c87dcec6589b931935c14e4..66f6459d5f71f35249809f98dee02e20192c4db4 100644 (file)
--- a/lib/dns/cache.c
+++ b/lib/dns/cache.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: cache.c,v 1.55 2003/10/13 00:40:29 marka Exp $ */
+/* $Id: cache.c,v 1.56 2003/10/15 07:01:45 marka Exp $ */
 
 #include <config.h>
 
@@ -248,7 +248,9 @@ dns_cache_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
        for (i = 0; i < cache->db_argc; i++)
                if (cache->db_argv[i] != NULL)
                        isc_mem_free(mctx, cache->db_argv[i]);
-       isc_mem_put(mctx, cache->db_argv, cache->db_argc * sizeof(char *));
+       if (cache->db_argv != NULL)
+               isc_mem_put(mctx, cache->db_argv,
+                           cache->db_argc * sizeof(char *));
  cleanup_dbtype:
        isc_mem_free(mctx, cache->db_type);
  cleanup_filelock:
@@ -565,6 +567,8 @@ cache_cleaner_init(dns_cache_t *cache, isc_taskmgr_t *taskmgr,
        return (ISC_R_SUCCESS);
 
  cleanup:
+       if (cleaner->overmem_event != NULL)
+               isc_event_free(&cleaner->overmem_event);
        if (cleaner->resched_event != NULL)
                isc_event_free(&cleaner->resched_event);
        if (cleaner->cleaning_timer != NULL)