From e307273307f5f22cee475cd6049a440ba53f6761 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= Date: Sat, 20 Jul 2019 17:54:05 -0400 Subject: [PATCH] Fix unprotected access to rbtnode in lib/dns/rbtdb.c:add32() --- lib/dns/rbtdb.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c index 3033e8f5861..d7d65c047bb 100644 --- a/lib/dns/rbtdb.c +++ b/lib/dns/rbtdb.c @@ -6263,16 +6263,18 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion, INSIST(!loading); INSIST(rbtversion == NULL || rbtversion->serial >= topheader->serial); - if (topheader_prev != NULL) + if (topheader_prev != NULL) { topheader_prev->next = newheader; - else + } else { rbtnode->data = newheader; + } newheader->next = topheader->next; newheader->down = topheader; topheader->next = newheader; rbtnode->dirty = 1; - if (changed != NULL) + if (changed != NULL) { changed->dirty = true; + } } else { /* * No rdatasets of the given type exist at the node. @@ -7058,8 +7060,15 @@ loading_addrdataset(void *arg, const dns_name_t *name, newheader->resign_lsb = 0; } + NODE_LOCK(&rbtdb->node_locks[node->locknum].lock, + isc_rwlocktype_write); + result = add32(rbtdb, node, rbtdb->current_version, newheader, DNS_DBADD_MERGE, true, NULL, 0); + + NODE_UNLOCK(&rbtdb->node_locks[node->locknum].lock, + isc_rwlocktype_write); + if (result == ISC_R_SUCCESS && delegating_type(rbtdb, node, rdataset->type)) node->find_callback = 1; -- GitLab