[v9_9] reference leak with AAAA glue but not A

4004.	[bug]		When delegations had AAAA glue but not A, a
			reference could be leaked causing an assertion
			failure on shutdown. [RT #37796]

(cherry picked from commit c4abb197160a74f7cd4ad23ebc63fbe0194010ab)
(cherry picked from commit 96b6923a2557788616f32456f7a3977a1de68020)

diff --git a/CHANGES b/CHANGES
index 85da655bc4096e0ec29ce48960c431502fd366f1..be559469e238a73216605b9b05c0b0b494f16161 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+4004.  [bug]           When delegations had AAAA glue but not A, a
+                       reference could be leaked causing an assertion
+                       failure on shutdown. [RT #37796]
+
 4000.  [bug]           NXDOMAIN redirection incorrectly handled NXRRSET
                        from the redirect zone. [RT #37722]
 

diff --git a/bin/check/named-checkconf.c b/bin/check/named-checkconf.c
index a75df96d1fea91f7f94a073080c90a5499eea7dc..18cfdddc98bd566a76d81b571586d24d3b86c96c 100644 (file)
--- a/bin/check/named-checkconf.c
+++ b/bin/check/named-checkconf.c
@@ -488,7 +488,33 @@ main(int argc, char **argv) {
 
        isc_commandline_errprint = ISC_FALSE;
 
-       while ((c = isc_commandline_parse(argc, argv, "dhjt:pvxz")) != EOF) {
+       /*
+        * Process memory debugging argument first.
+        */
+#define CMDLINE_FLAGS "dhjm:t:pvxz"
+       while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
+               switch (c) {
+               case 'm':
+                       if (strcasecmp(isc_commandline_argument, "record") == 0)
+                               isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
+                       if (strcasecmp(isc_commandline_argument, "trace") == 0)
+                               isc_mem_debugging |= ISC_MEM_DEBUGTRACE;
+                       if (strcasecmp(isc_commandline_argument, "usage") == 0)
+                               isc_mem_debugging |= ISC_MEM_DEBUGUSAGE;
+                       if (strcasecmp(isc_commandline_argument, "size") == 0)
+                               isc_mem_debugging |= ISC_MEM_DEBUGSIZE;
+                       if (strcasecmp(isc_commandline_argument, "mctx") == 0)
+                               isc_mem_debugging |= ISC_MEM_DEBUGCTX;
+                       break;
+               default:
+                       break;
+               }
+       }
+       isc_commandline_reset = ISC_TRUE;
+
+       RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
+
+       while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != EOF) {
                switch (c) {
                case 'd':
                        debug++;
@@ -498,6 +524,9 @@ main(int argc, char **argv) {
                        nomerge = ISC_FALSE;
                        break;
 
+               case 'm':
+                       break;
+
                case 't':
                        result = isc_dir_chroot(isc_commandline_argument);
                        if (result != ISC_R_SUCCESS) {
@@ -557,8 +586,6 @@ main(int argc, char **argv) {
        InitSockets();
 #endif
 
-       RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
-
        RUNTIME_CHECK(setup_logging(mctx, stdout, &logc) == ISC_R_SUCCESS);
 
        RUNTIME_CHECK(isc_entropy_create(mctx, &ectx) == ISC_R_SUCCESS);

diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
index 0d2fe70836e44a7db3e5ee6c191bcb910db901a4..ec32378e66842b6e3d8ff6af8030693cec69df8b 100644 (file)
--- a/doc/arm/notes.xml
+++ b/doc/arm/notes.xml
@@ -165,6 +165,15 @@
          is not present will now return NOERROR instead of NXDOMAIN.
         </para>
       </listitem>
+      <listitem>
+        <para>
+         When a zone contained a delegation to an IPv6 name server
+         but not an IPv4 name server, it was possible for a memory
+         reference to be left un-freed. This caused an assertion
+         failure on server shutdown, but was otherwise harmless.
+         [RT #37796]
+        </para>
+      </listitem>
     </itemizedlist>
   </sect2>
   <sect2 id="end_of_life">

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index b7a04ea5c993d6be81f00d8110360ff3621f1dcb..b1cfd4597f28dd98a1d42e34e9a672e40dd31b8f 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -2342,6 +2342,8 @@ zone_check_glue(dns_zone_t *zone, dns_db_t *db, dns_name_t *name,
                                     DNS_DBFIND_GLUEOK, 0, NULL,
                                     foundname, &aaaa, NULL);
                if (tresult == ISC_R_SUCCESS) {
+                       if (dns_rdataset_isassociated(&a))
+                               dns_rdataset_disassociate(&a);
                        dns_rdataset_disassociate(&aaaa);
                        return (ISC_TRUE);
                }