4060. [bug] dns_rdata_freestruct could be call on a uninitialised

                        structure when handling a error. [RT #38568]

diff --git a/CHANGES b/CHANGES
index 5401e2729f3f396b272d830609cd319f1fd7e73b..771b0229fcaa2617e910af4e5ecfe81537718851 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4060.  [bug]           dns_rdata_freestruct could be call on a uninitialised
+                       structure when handling a error. [RT #38568]
+
 4059.  [bug]           Addressed valgrind warnings. [RT #38549]
 
 4058.  [bug]           UDP dispatches could use the wrong psuedorandom

diff --git a/lib/dns/tkey.c b/lib/dns/tkey.c
index fd559176e5b8c3511009894cd21365910cfca17d..263988b575399f0529adc08985a2e6538c9bec04 100644 (file)
--- a/lib/dns/tkey.c
+++ b/lib/dns/tkey.c
@@ -1403,6 +1403,7 @@ dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg,
        dst_key_t *dstkey = NULL;
        isc_result_t result;
        unsigned char array[1024];
+       isc_boolean_t freertkey = ISC_FALSE;
 
        REQUIRE(qmsg != NULL);
        REQUIRE(rmsg != NULL);
@@ -1415,6 +1416,7 @@ dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg,
 
        RETERR(find_tkey(rmsg, &tkeyname, &rtkeyrdata, DNS_SECTION_ANSWER));
        RETERR(dns_rdata_tostruct(&rtkeyrdata, &rtkey, NULL));
+       freertkey = ISC_TRUE;
 
        if (win2k == ISC_TRUE)
                RETERR(find_tkey(qmsg, &tkeyname, &qtkeyrdata,
@@ -1467,7 +1469,8 @@ dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg,
        /*
         * XXXSRA This probably leaks memory from qtkey.
         */
-       dns_rdata_freestruct(&rtkey);
+       if (freertkey)
+               dns_rdata_freestruct(&rtkey);
        if (dstkey != NULL)
                dst_key_free(&dstkey);
        return (result);