Commit 7dfef18b authored by Evan Hunt's avatar Evan Hunt

Merge branch '942-security-move-test-inside-lock' into security-master

parents 95ecdcd7 f1b9bd6f
......@@ -28,7 +28,10 @@
5245. [cleanup] Reduce logging level for IXFR up-to-date poll
responses. [GL #1009]
5244. [placeholder]
5244. [security] Fixed a race condition in dns_dispatch_getnext()
that could cause an assertion failure if a
significant number of incoming packets were
rejected. (CVE-2019-6471) [GL #942]
5243. [bug] Fix a possible race between dispatcher and socket
code in a high-load cold-cache resolver scenario.
......@@ -97,7 +97,15 @@
The TCP client quota set using the <command>tcp-clients</command>
option could be exceeded in some cases. This could lead to
exhaustion of file descriptors. (CVE-2018-5743) [GL #615]
exhaustion of file descriptors. This flaw is disclosed in
CVE-2018-5743. [GL #615]
A race condition could trigger an assertion failure when
a large number of incoming packets were being rejected.
This flaw is disclosed in CVE-2019-6471. [GL #942]
......@@ -126,7 +126,7 @@ struct dns_dispentry {
isc_task_t *task;
isc_taskaction_t action;
void *arg;
bool item_out;
bool item_out;
dispsocket_t *dispsocket;
ISC_LIST(dns_dispatchevent_t) items;
ISC_LINK(dns_dispentry_t) link;
......@@ -3271,13 +3271,14 @@ dns_dispatch_getnext(dns_dispentry_t *resp, dns_dispatchevent_t **sockevent) {
disp = resp->disp;
REQUIRE(resp->item_out == true);
resp->item_out = false;
ev = *sockevent;
*sockevent = NULL;
REQUIRE(resp->item_out == true);
resp->item_out = false;
if (ev->buffer.base != NULL)
free_buffer(disp, ev->buffer.base, ev->buffer.length);
free_devent(disp, ev);
......@@ -3422,6 +3423,9 @@ dns_dispatch_removeresponse(dns_dispentry_t **resp,
isc_task_send(disp->task[0], &disp->ctlevent);
* disp must be locked.
static void
do_cancel(dns_dispatch_t *disp) {
dns_dispatchevent_t *ev;
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment