use after free in catalog zone processing
I was in the process of adding tls restricted transfers to the catz system test and hadn't properly modified everything (see attached diff) and ns2 dropped core from what looks like a use after free error.
The end of ns2/named.run:
17-Nov-2022 19:11:31.886 received message from 10.53.0.1#5300
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25047
;; flags: qr aa; QUESTION: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;catalog1.example. IN IXFR
;; ANSWER SECTION:
catalog1.example. 3600 IN SOA . . 64 86400 3600 86400 3600
catalog1.example. 3600 IN SOA . . 63 86400 3600 86400 3600
catalog1.example. 3600 IN SOA . . 64 86400 3600 86400 3600
1ba056ba375209a66a2c9a0617b1df714b998112.zones.catalog1.example. 3600 IN PTR tls1.example.
catalog1.example. 3600 IN SOA . . 64 86400 3600 86400 3600
17-Nov-2022 19:11:31.886 transfer of 'catalog1.example/IN/default' from 10.53.0.1#5300: got incremental response
17-Nov-2022 19:11:31.886 writing to journal
17-Nov-2022 19:11:31.886 del catalog1.example. 3600 IN SOA . . 63 86400 3600 86400 3600
17-Nov-2022 19:11:31.886 add catalog1.example. 3600 IN SOA . . 64 86400 3600 86400 3600
17-Nov-2022 19:11:31.886 add 1ba056ba375209a66a2c9a0617b1df714b998112.zones.catalog1.example. 3600 IN PTR tls1.example.
17-Nov-2022 19:11:31.886 dns_zone_verifydb: zone catalog1.example/IN/default: enter
17-Nov-2022 19:11:31.886 catz.c:2041:dns_catz_dbupdate_callback(): fatal error:
17-Nov-2022 19:11:31.886 pthread_mutex_lock(): Invalid argument (22)
17-Nov-2022 19:11:31.886 exiting (due to fatal error in library)Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0 libsystem_kernel.dylib 0x000000019869ce28 __pthread_kill + 8
1 libsystem_pthread.dylib 0x00000001986cf43c pthread_kill + 292
2 libsystem_c.dylib 0x0000000198617454 abort + 124
3 named 0x000000010446a42c library_fatal_error + 356 (main.c:278)
4 libisc-9.19.8-dev.dylib 0x00000001049cec7c isc_error_fatal + 72 (error.c:70)
5 libdns-9.19.8-dev.dylib 0x0000000104535c6c dns_catz_dbupdate_callback + 312 (catz.c:2041)
6 libdns-9.19.8-dev.dylib 0x000000010453a37c dns_db_closeversion + 264 (db.c:412)
7 libdns-9.19.8-dev.dylib 0x00000001046b514c ixfr_commit + 164 (xfrin.c:478)
8 libdns-9.19.8-dev.dylib 0x00000001046b4b54 xfr_rr + 1444 (xfrin.c:631)
9 libdns-9.19.8-dev.dylib 0x00000001046b3f54 xfrin_recv_done + 2544 (xfrin.c:1412)
10 libisc-9.19.8-dev.dylib 0x00000001049b4420 isc__nm_async_readcb + 408 (netmgr.c:2253)
11 libisc-9.19.8-dev.dylib 0x00000001049b2180 isc__nm_readcb + 332 (netmgr.c:2226)
12 libisc-9.19.8-dev.dylib 0x00000001049bd040 isc__nm_tcpdns_processbuffer + 636 (tcpdns.c:851)
13 libisc-9.19.8-dev.dylib 0x00000001049b2da8 processbuffer + 60 (netmgr.c:1722)
14 libisc-9.19.8-dev.dylib 0x00000001049b2c6c isc__nm_process_sock_buffer + 52 (netmgr.c:1743)
15 libisc-9.19.8-dev.dylib 0x00000001049bd340 isc__nm_tcpdns_read_cb + 604 (tcpdns.c:914)
16 libuv.1.dylib 0x00000001056de570 uv__stream_io + 1020
17 libuv.1.dylib 0x00000001056e57c0 uv__io_poll + 1744
18 libuv.1.dylib 0x00000001056d5d00 uv_run + 252
19 libisc-9.19.8-dev.dylib 0x00000001049e5504 loop_run + 460 (loop.c:270)
20 libisc-9.19.8-dev.dylib 0x00000001049e3c08 loop_thread + 44 (loop.c:297)
21 libisc-9.19.8-dev.dylib 0x00000001049e3ac0 isc_loopmgr_run + 456 (loop.c:477)
22 named 0x0000000104469fc4 main + 424 (main.c:1545)
23 libdyld.dylib 0x00000001986ed430 start + 4