From: Mukund Sivaraman <muks@isc.org>
Date: Tue, 19 Sep 2017 14:12:13 +0000 (+0530)
Subject: Fix use after free when closing an LMDB (#46000)
X-Git-Tag: v9.12.0b1~167
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=e2ed24aa4ddf10b24596ef91de3e81258638c627;p=thirdparty%2Fbind9.git

Fix use after free when closing an LMDB (#46000)
---

diff --git a/CHANGES b/CHANGES
index 1b4ca0fe33b..2c1d7f6bf7b 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+4781.	[bug]		Fix use after free when closing an LMDB. [RT #46000]
+
 4780.	[bug]		Fix out of bounds access in DHCID totext() method.
 			[RT #46001]
 
diff --git a/bin/named/server.c b/bin/named/server.c
index 162ff90d2d8..eb728cf3509 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -11833,29 +11833,35 @@ static void
 nzd_env_close(dns_view_t *view) {
 	if (view->new_zone_dbenv != NULL) {
 		const char *dbpath = NULL;
+		isc_boolean_t have_dbpath = ISC_FALSE;
+		char dbpath_copy[PATH_MAX];
 		char lockpath[PATH_MAX];
 		int ret;
 
 		if (mdb_env_get_path(view->new_zone_dbenv, &dbpath) == 0) {
+			have_dbpath = ISC_TRUE;
 			snprintf(lockpath, sizeof(lockpath), "%s-lock",
 				 dbpath);
+			strlcpy(dbpath_copy, dbpath, sizeof(dbpath_copy));
 		}
 
 		mdb_env_close((MDB_env *) view->new_zone_dbenv);
 		view->new_zone_dbenv = NULL;
 
-		/*
-		 * Database files must be owned by the eventual user, not
-		 * by root.
-		 */
-		ret = chown(dbpath, ns_os_uid(), -1);
-		UNUSED(ret);
+		if (have_dbpath) {
+			/*
+			 * Database files must be owned by the eventual user, not
+			 * by root.
+			 */
+			ret = chown(dbpath_copy, ns_os_uid(), -1);
+			UNUSED(ret);
 
-		 /*
-		  * Some platforms need the lockfile not to exist when we
-		  * reopen the environment.
-		 */
-		(void) isc_file_remove(lockpath);
+			/*
+			 * Some platforms need the lockfile not to exist when we
+			 * reopen the environment.
+			 */
+			(void) isc_file_remove(lockpath);
+		}
 	}
 }