From: Mark Andrews <marka@isc.org>
Date: Mon, 18 Feb 2013 09:24:24 +0000 (+1100)
Subject: 3488.   [bug]           Use after free error with DH generated keys. [RT #32649]
X-Git-Tag: v9.10.0a1~510
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=3c7df84b2019e454f6333ca354ef709f6451a2ab;p=thirdparty%2Fbind9.git

3488.   [bug]           Use after free error with DH generated keys. [RT #32649]
---

diff --git a/CHANGES b/CHANGES
index 88344538ff8..640292cba7d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+3488.	[bug]		Use after free error with DH generated keys. [RT #32649]
+
 3487.	[bug]		Change 3444 was not complete.  There was a additional
 			place where the NOQNAME proof needed to be saved.
                         [RT #32629]
diff --git a/bin/tests/system/tkey/tests.sh b/bin/tests/system/tkey/tests.sh
index 3a4e2d97453..f60fe7a2f4f 100644
--- a/bin/tests/system/tkey/tests.sh
+++ b/bin/tests/system/tkey/tests.sh
@@ -31,6 +31,7 @@ ret=0
 dhkeyname=`$KEYGEN -T KEY -a DH -b 768 -n host -r $RANDFILE client` || ret=1
 if [ $ret != 0 ]; then
 	echo "I:failed"
+	status=`expr $status + $ret`
 	echo "I:exit status: $status"
 	exit $status
 fi
@@ -43,6 +44,7 @@ do
 	keyname=`./keycreate $dhkeyname $owner` || ret=1
 	if [ $ret != 0 ]; then
 		echo "I:failed"
+		status=`expr $status + $ret`
 		echo "I:exit status: $status"
 		exit $status
 	fi
@@ -84,6 +86,7 @@ ret=0
 keyname=`./keycreate $dhkeyname bar.example.` || ret=1
 if [ $ret != 0 ]; then
         echo "I:failed"
+	status=`expr $status + $ret`
         echo "I:exit status: $status"
         exit $status
 fi
@@ -124,6 +127,7 @@ ret=0
 keyname=`./keycreate $dhkeyname bar.example.` || ret=1
 if [ $ret != 0 ]; then
         echo "I:failed"
+	status=`expr $status + $ret`
         echo "I:exit status: $status"
         exit $status
 fi
diff --git a/lib/dns/tkey.c b/lib/dns/tkey.c
index 0112f7ec760..7719db18084 100644
--- a/lib/dns/tkey.c
+++ b/lib/dns/tkey.c
@@ -991,8 +991,13 @@ dns_tkey_builddhquery(dns_message_t *msg, dst_key_t *key, dns_name_t *name,
 
 	ISC_LIST_INIT(namelist);
 	RETERR(add_rdata_to_list(msg, &keyname, rdata, 0, &namelist));
-	dns_message_addname(msg, ISC_LIST_HEAD(namelist),
-			    DNS_SECTION_ADDITIONAL);
+	name = ISC_LIST_HEAD(namelist);
+	while (name != NULL) {
+		dns_name_t *next = ISC_LIST_NEXT(name, link);
+		ISC_LIST_UNLINK(namelist, name, link);
+		dns_message_addname(msg, name, DNS_SECTION_ADDITIONAL);
+		name = next;
+	}
 
 	return (ISC_R_SUCCESS);
 
diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
index 72969a69482..c7768f4c788 100644
--- a/lib/dns/tsig.c
+++ b/lib/dns/tsig.c
@@ -240,7 +240,7 @@ adjust_lru(dns_tsigkey_t *tkey) {
 		 * removing the read lock and aquiring the write lock.
 		 */
 		if (ISC_LINK_LINKED(tkey, link) &&
-		    (tkey->ring->lru).head != tkey)
+		    tkey->ring->lru.tail != tkey)
 		{
 			ISC_LIST_UNLINK(tkey->ring->lru, tkey, link);
 			ISC_LIST_APPEND(tkey->ring->lru, tkey, link);
@@ -1768,11 +1768,15 @@ static void
 free_tsignode(void *node, void *_unused) {
 	dns_tsigkey_t *key;
 
-	UNUSED(_unused);
-
 	REQUIRE(node != NULL);
 
+	UNUSED(_unused);
+
 	key = node;
+	if (key->generated) {
+		if (ISC_LINK_LINKED(key, link))
+			ISC_LIST_UNLINK(key->ring->lru, key, link);
+	}
 	dns_tsigkey_detach(&key);
 }