3670. [bug] Address read after free in server side of

                        lwres_getrrsetbyname. [RT #29075]

diff --git a/CHANGES b/CHANGES
index de3810bf93717d47b1209e5bd0103180f5c13178..ac9eb206cb9deaad8ab66a29153715a5b00141bf 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3670.  [bug]           Address read after free in server side of
+                       lwres_getrrsetbyname. [RT #29075]
+
 3669.  [port]          freebsd: --with-gssapi needs -lhx509. [RT #35001]
 
 3668.  [bug]           Fix cast in lex.c which could see 0xff treated as eof.

diff --git a/bin/named/lwdgrbn.c b/bin/named/lwdgrbn.c
index 5c858cbedacd4d4a21f592a339785802a2c55520..47649e0153a5e7243035de12f54f204b13335f56 100644 (file)
--- a/bin/named/lwdgrbn.c
+++ b/bin/named/lwdgrbn.c
@@ -324,9 +324,6 @@ lookup_done(isc_task_t *task, isc_event_t *event) {
                                 (grbn->nsigs == 1) ? "" : "s");
        }
 
-       dns_lookup_destroy(&client->lookup);
-       isc_event_free(&event);
-
        /*
         * Render the packet.
         */
@@ -362,6 +359,9 @@ lookup_done(isc_task_t *task, isc_event_t *event) {
 
        NS_LWDCLIENT_SETSEND(client);
 
+       dns_lookup_destroy(&client->lookup);
+       isc_event_free(&event);
+
        return;
 
  out: