From: Evan Hunt <each@isc.org>
Date: Wed, 15 Apr 2015 22:38:14 +0000 (-0700)
Subject: [master] use after free in resquery_destroy()
X-Git-Tag: v9.11.0a1~874
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=c03fe78ef59b2373233db1a7b568cc2000d6d3b4;p=thirdparty%2Fbind9.git

[master] use after free in resquery_destroy()

4102.	[bug]		Fix a use after free bug introduced in change
			#4094.  [RT #39281]
---

diff --git a/CHANGES b/CHANGES
index dd0e4f22de1..dc9bd37e355 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4102.	[bug]		Fix a use after free bug introduced in change
+			#4094.  [RT #39281]
+
 4101.	[bug]		dig: the +split and +rrcomments options didn't
 			work with +short. [RT #39291]
 
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 3318b61b739..821d53dd715 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -823,6 +823,7 @@ resquery_destroy(resquery_t **queryp) {
 	isc_boolean_t empty;
 	resquery_t *query;
 	fetchctx_t *fctx;
+	unsigned int bucket;
 
 	REQUIRE(queryp != NULL);
 	query = *queryp;
@@ -832,12 +833,13 @@ resquery_destroy(resquery_t **queryp) {
 
 	fctx = query->fctx;
 	res = fctx->res;
+	bucket = fctx->bucketnum;
 
 	fctx->nqueries--;
 
-	LOCK(&res->buckets[fctx->bucketnum].lock);
+	LOCK(&res->buckets[bucket].lock);
 	empty = fctx_decreference(query->fctx);
-	UNLOCK(&res->buckets[fctx->bucketnum].lock);
+	UNLOCK(&res->buckets[bucket].lock);
 
 	query->magic = 0;
 	isc_mem_put(query->mctx, query, sizeof(*query));