From: Evan Hunt <each@isc.org>
Date: Fri, 3 May 2013 21:00:12 +0000 (-0700)
Subject: [master] fix corrupt map file handling
X-Git-Tag: v9.10.0a1~364
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=1a076410c260ff1d3124ce8b7e22ac111e9cf92a;p=thirdparty%2Fbind9.git

[master] fix corrupt map file handling

3564.	[bug]		Improved handling of corrupted map files. [RT #33380]
---

diff --git a/CHANGES b/CHANGES
index 5be72cdba45..a72f4bd00b7 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+3564.	[bug]		Improved handling of corrupted map files. [RT #33380]
+
 3563.	[contrib]	zone2sqlite failed with some table names. [RT #33375]
 
 3562.	[func]		Update map file header format to include a SHA-1 hash
diff --git a/bin/tests/system/masterformat/tests.sh b/bin/tests/system/masterformat/tests.sh
index 63b7b4bdaf7..032a3b4ec9f 100755
--- a/bin/tests/system/masterformat/tests.sh
+++ b/bin/tests/system/masterformat/tests.sh
@@ -241,7 +241,8 @@ ret=0
 ./named-compilezone -D -f text -F map -o map.5 example.nil baseline.txt > /dev/null
 cp map.5 badmap
 stomp badmap 2754 2 99
-./named-compilezone -D -f map -F text -o text.5 example.nil badmap > /dev/null && ret=1
+./named-compilezone -D -f map -F text -o text.5 example.nil badmap > /dev/null
+[ $? = 1 ] || ret=1
 [ $ret -eq 0 ] || echo "I:failed"
 status=`expr $status + $ret`
 
@@ -249,7 +250,8 @@ echo "I:checking corrupt map files fail to load (bad node data)"
 ret=0
 cp map.5 badmap
 stomp badmap 2897 5 127
-./named-compilezone -D -f map -F text -o text.5 example.nil badmap > /dev/null && ret=1
+./named-compilezone -D -f map -F text -o text.5 example.nil badmap > /dev/null
+[ $? = 1 ] || ret=1
 [ $ret -eq 0 ] || echo "I:failed"
 status=`expr $status + $ret`
 
diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c
index 675fc0331a7..4206bcb55dc 100644
--- a/lib/dns/rbt.c
+++ b/lib/dns/rbt.c
@@ -776,16 +776,17 @@ dns_rbt_deserialize_tree(void *base_address, off_t header_offset,
 	file_header_t *header;
 	unsigned char digest[ISC_SHA1_DIGESTLENGTH];
 	isc_sha1_t sha1;
+	dns_rbt_t *rbt = NULL;
 
 	REQUIRE(originp == NULL || *originp == NULL);
 
 	isc_sha1_init(&sha1);
 
-	result = dns_rbt_create(mctx, deleter, deleter_arg, rbtp);
+	result = dns_rbt_create(mctx, deleter, deleter_arg, &rbt);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
-	(*rbtp)->mmap_location = base_address;
+	rbt->mmap_location = base_address;
 
 	header = (file_header_t *)((char *)base_address + header_offset);
 
@@ -808,21 +809,26 @@ dns_rbt_deserialize_tree(void *base_address, off_t header_offset,
 	}
 
 	/* Copy other data items from the header into our rbt. */
-	(*rbtp)->root = (dns_rbtnode_t *)((char *)base_address +
+	rbt->root = (dns_rbtnode_t *)((char *)base_address +
 				header_offset + header->first_node_offset);
-	(*rbtp)->nodecount = header->nodecount;
-	treefix(*rbtp, (*rbtp)->root, dns_rootname, datafixer, &sha1);
+	rbt->nodecount = header->nodecount;
+	treefix(rbt, rbt->root, dns_rootname, datafixer, &sha1);
 
 	isc_sha1_final(&sha1, digest);
 #ifdef DEBUG
 	hexdump("deserializing digest", digest, sizeof(digest));
 #endif
 
-	if (memcmp(header->digest, digest, sizeof(digest)) != 0)
+	if (memcmp(header->digest, digest, sizeof(digest)) != 0) {
+		rbt->root = NULL;
+		rbt->nodecount = 0;
+		dns_rbt_destroy(&rbt);
 		return (ISC_R_INVALIDFILE);
+	}
 
+	*rbtp = rbt;
 	if (originp != NULL)
-		*originp = (*rbtp)->root;
+		*originp = rbt->root;
 
 	return (ISC_R_SUCCESS);
 }