[v9_6] double free caused assertion in acache

3553.	[bug]		Address suspected double free in acache. [RT #33252]
(cherry picked from commit 11b04b18f8ecb7c0119a7a6b6bbf8f5bad789c9a)
(cherry picked from commit 3673e8535584457ec1a79b6a30ddf4d182b0f921)

diff --git a/CHANGES b/CHANGES
index 228628d7d6a714ead4125fe9f65e0eaf6674ca0a..1a1f363465532cb4fda11bd8c5da2cb1530622f1 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,7 @@
+3553.  [bug]           Address suspected double free in acache. [RT #33252]
+
 3552.  [bug]           Wrong getopt option string for 'nsupdate -r'.
-                       [RT# 33280]
+                       [RT #33280]
 
 3549.  [doc]           Documentation for "request-nsid" was missing.
                        [RT #33153]

diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index 9df6e29f44e8b8de4cf150d72663cf32b6212852..7b0fa84060707cef436586dc0d0766fdd98f0b77 100644 (file)
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -8382,11 +8382,10 @@ acache_callback(dns_acacheentry_t *entry, void **arg) {
        if (acarray != NULL && acarray[count].entry == entry) {
                acarray[count].entry = NULL;
                INSIST(acarray[count].cbarg == cbarg);
-               isc_mem_put(rbtdb->common.mctx, cbarg, sizeof(acache_cbarg_t));
                acarray[count].cbarg = NULL;
-               dns_acache_detachentry(&entry);
-       } else
                isc_mem_put(rbtdb->common.mctx, cbarg, sizeof(acache_cbarg_t));
+               dns_acache_detachentry(&entry);
+       }
 
        NODE_UNLOCK(nodelock, isc_rwlocktype_write);