From: Mark Andrews <marka@isc.org>
Date: Fri, 2 Apr 2004 05:13:25 +0000 (+0000)
Subject: 1604.   [bug]           A xfrout_ctx_create() failure would result in
X-Git-Tag: v9.2.3rc4^3~94
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=4995dba770c1f5f421cf22a2e9e138586a153765;p=thirdparty%2Fbind9.git

1604.   [bug]           A xfrout_ctx_create() failure would result in
                        xfrout_ctx_destroy() being called with a
                        partially initaliased structure.
---

diff --git a/CHANGES b/CHANGES
index 07b91cf2ba4..09911b61754 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+1604.	[bug]		A xfrout_ctx_create() failure would result in
+			xfrout_ctx_destroy() being called with a
+			partially initaliased structure.
+			
 1603.	[placeholder]	rt10929.
 
 1602.	[placeholder]	rt10925.
diff --git a/bin/named/xfrout.c b/bin/named/xfrout.c
index fb2cb2246ee..0d260870dcc 100644
--- a/bin/named/xfrout.c
+++ b/bin/named/xfrout.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: xfrout.c,v 1.115 2004/03/05 04:57:49 marka Exp $ */
+/* $Id: xfrout.c,v 1.116 2004/04/02 05:13:25 marka Exp $ */
 
 #include <config.h>
 
@@ -1142,8 +1142,6 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 				&xfr));
 	xfr->mnemonic = mnemonic;
 	stream = NULL;
-	db = NULL;
-	ver = NULL;
 	quota = NULL;
 
 	CHECK(xfr->stream->methods->first(xfr->stream));
@@ -1225,10 +1223,10 @@ xfrout_ctx_create(isc_mem_t *mctx, ns_client_t *client, unsigned int id,
 	xfr->qname = qname;
 	xfr->qtype = qtype;
 	xfr->qclass = qclass;
-	xfr->db = db;
-	xfr->ver = ver;
-	xfr->quota = quota;
-	xfr->stream = stream;
+	xfr->db = NULL;
+	xfr->ver = NULL;
+	dns_db_attach(db, &xfr->db);
+	dns_db_attachversion(db, ver, &xfr->ver);
 	xfr->end_of_stream = ISC_FALSE;
 	xfr->tsigkey = tsigkey;
 	xfr->lasttsig = lasttsig;
@@ -1239,6 +1237,12 @@ xfrout_ctx_create(isc_mem_t *mctx, ns_client_t *client, unsigned int id,
 	xfr->sends = 0;
 	xfr->shuttingdown = ISC_FALSE;
 	xfr->mnemonic = NULL;
+	xfr->buf.base = NULL;
+	xfr->buf.length = 0;
+	xfr->txmem = NULL;
+	xfr->txmemlen = 0;
+	xfr->stream = NULL;
+	xfr->quota = NULL;
 
 	/*
 	 * Allocate a temporary buffer for the uncompressed response
@@ -1283,6 +1287,12 @@ xfrout_ctx_create(isc_mem_t *mctx, ns_client_t *client, unsigned int id,
 	 */
 	xfr->client->shutdown = xfrout_client_shutdown;
 	xfr->client->shutdown_arg = xfr;
+	/*
+	 * These MUST be after the last "goto failure;" / CHECK to
+	 * prevent a double free by the caller.
+	 */
+	xfr->quota = quota;
+	xfr->stream = stream;
 
 	*xfrp = xfr;
 	return (ISC_R_SUCCESS);