Pointers Dereferenced before Being Checked
In several places pointers are dereferenced before being checked against NULL. In the listing, the pointer mgr is dereferenced to assign worker and then checked for validity, which includes a NULL pointer check. In case mgr is NULL, invalid memory is getting read which likely leads to a crash instead of a more controlled abort.
void
isc_nm_streamdnsconnect(isc_nm_t *mgr, isc_sockaddr_t *local,
isc_sockaddr_t *peer, isc_nm_cb_t cb, void *cbarg,
unsigned int timeout, isc_tlsctx_t *ctx,
isc_tlsctx_client_session_cache_t *client_sess_cache) {
isc_nmsocket_t *nsock = NULL;
isc__networker_t *worker = &mgr->workers[isc_tid()];
REQUIRE(VALID_NM(mgr));
Similar code exists in isc_nm_listenstreamdns(), isc_nm_tcpconnect(), isc_nm_listentls(), isc_nm_tlsconnect(), isc_nm_tcpconnect() and isc_nm_udpconnect(). sock is used in a similar pattern in isc__nm_udp_send(). The stats pointer in dns_dnssecsignstats_increment() and dns_dnssecsignstats_clear() is accessed in the same way.