2599. [bug] Address rapid memory growth when validation fails.

                        [RT #19654]

diff --git a/CHANGES b/CHANGES
index b41ab64fbffa63a6755eb9878e2f2c3e56586ec9..e458fc2849d976b706d84e895d58bc2654115821 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+2599.  [bug]           Address rapid memory growth when validation fails.
+                       [RT #19654]
+
 2595.  [bug]           Fix unknown extended rcodes in dig. [RT #19625]
 
 2592.  [bug]           Treat "any" as a type in nsupdate. [RT #19455]

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 3b1144bb68f9e624ad0152a7a58af86a42f6c441..319a6c8d5107834040015cd94bb296a2e5690a47 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: resolver.c,v 1.284.18.87 2009/02/28 05:39:35 marka Exp $ */
+/* $Id: resolver.c,v 1.284.18.88 2009/05/11 02:32:43 marka Exp $ */
 
 /*! \file */
 
@@ -3958,53 +3958,53 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo,
                        rdataset->trust = dns_trust_pending;
                        if (sigrdataset != NULL)
                                sigrdataset->trust = dns_trust_pending;
-                       if (!need_validation)
+                       if (!need_validation || !ANSWER(rdataset)) {
                                addedrdataset = ardataset;
-                       else
-                               addedrdataset = NULL;
-                       result = dns_db_addrdataset(fctx->cache, node, NULL,
-                                                   now, rdataset, 0,
-                                                   addedrdataset);
-                       if (result == DNS_R_UNCHANGED) {
-                               result = ISC_R_SUCCESS;
-                               if (!need_validation &&
-                                   ardataset != NULL &&
-                                   ardataset->type == 0) {
-                                       /*
-                                        * The answer in the cache is better
-                                        * than the answer we found, and is
-                                        * a negative cache entry, so we
-                                        * must set eresult appropriately.
-                                        */
-                                       if (NXDOMAIN(ardataset))
-                                               eresult = DNS_R_NCACHENXDOMAIN;
-                                       else
-                                               eresult = DNS_R_NCACHENXRRSET;
-                                       /*
-                                        * We have a negative response from
-                                        * the cache so don't attempt to
-                                        * add the RRSIG rrset.
-                                        */
-                                       continue;
-                               }
-                       }
-                       if (result != ISC_R_SUCCESS)
-                               break;
-                       if (sigrdataset != NULL) {
-                               if (!need_validation)
-                                       addedrdataset = asigrdataset;
-                               else
-                                       addedrdataset = NULL;
-                               result = dns_db_addrdataset(fctx->cache,
-                                                           node, NULL, now,
-                                                           sigrdataset, 0,
-                                                           addedrdataset);
-                               if (result == DNS_R_UNCHANGED)
+                               result = dns_db_addrdataset(fctx->cache, node,
+                                                           NULL, now, rdataset,
+                                                           0, addedrdataset);
+                               if (result == DNS_R_UNCHANGED) {
                                        result = ISC_R_SUCCESS;
+                                       if (!need_validation &&
+                                           ardataset != NULL &&
+                                           ardataset->type == 0) {
+                                               /*
+                                                * The answer in the cache is
+                                                * better than the answer we
+                                                * found, and is a negative
+                                                * cache entry, so we must set
+                                                * eresult appropriately.
+                                                */
+                                               if (NXDOMAIN(ardataset))
+                                                       eresult =
+                                                          DNS_R_NCACHENXDOMAIN;
+                                               else
+                                                       eresult =
+                                                          DNS_R_NCACHENXRRSET;
+                                               /*
+                                                * We have a negative response
+                                                * from the cache so don't
+                                                * attempt to add the RRSIG
+                                                * rrset.
+                                                */
+                                               continue;
+                                       }
+                               }
                                if (result != ISC_R_SUCCESS)
                                        break;
-                       } else if (!ANSWER(rdataset))
-                               continue;
+                               if (sigrdataset != NULL) {
+                                       addedrdataset = asigrdataset;
+                                       result = dns_db_addrdataset(fctx->cache,
+                                                               node, NULL, now,
+                                                               sigrdataset, 0,
+                                                               addedrdataset);
+                                       if (result == DNS_R_UNCHANGED)
+                                               result = ISC_R_SUCCESS;
+                                       if (result != ISC_R_SUCCESS)
+                                               break;
+                               } else if (!ANSWER(rdataset))
+                                       continue;
+                       } 
 
                        if (ANSWER(rdataset) && need_validation) {
                                if (fctx->type != dns_rdatatype_any &&