Blame SOURCES/bind-9.11.4-CVE-2023-2828-fixup.patch

ee1d55
From 6c26ede8edcb700caca12c501c6c129801989526 Mon Sep 17 00:00:00 2001
ee1d55
From: Mark Andrews <marka@isc.org>
ee1d55
Date: Fri, 23 Feb 2024 10:12:47 +1100
ee1d55
Subject: [PATCH] Do not use header_prev in expire_lru_headers
ee1d55
ee1d55
dns__cacherbt_expireheader can unlink / free header_prev underneath
ee1d55
it.  Use ISC_LIST_TAIL after calling dns__cacherbt_expireheader
ee1d55
instead to get the next pointer to be processed.
ee1d55
ee1d55
(cherry picked from commit 7ce2e86024f022decb2678963538515ca39ab4ab)
ee1d55
(cherry picked from commit f88f21b7d890eb80097f4bd434fedb29c2f9ff63)
ee1d55
---
ee1d55
 lib/dns/rbtdb.c | 8 ++++----
ee1d55
 1 file changed, 4 insertions(+), 4 deletions(-)
ee1d55
ee1d55
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
ee1d55
index e61cb21..4171039 100644
ee1d55
--- a/lib/dns/rbtdb.c
ee1d55
+++ b/lib/dns/rbtdb.c
ee1d55
@@ -10358,19 +10358,19 @@ update_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
ee1d55
 static size_t
ee1d55
 expire_lru_headers(dns_rbtdb_t *rbtdb, unsigned int locknum, size_t purgesize,
ee1d55
 		   isc_boolean_t tree_locked) {
ee1d55
-	rdatasetheader_t *header, *header_prev;
ee1d55
+	rdatasetheader_t *header;
ee1d55
 	size_t purged = 0;
ee1d55
 
ee1d55
 	for (header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]);
ee1d55
-	     header != NULL && purged <= purgesize; header = header_prev)
ee1d55
+	     header != NULL && purged <= purgesize;
ee1d55
+	     header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]))
ee1d55
 	{
ee1d55
-		header_prev = ISC_LIST_PREV(header, link);
ee1d55
 		/*
ee1d55
 		 * Unlink the entry at this point to avoid checking it
ee1d55
 		 * again even if it's currently used someone else and
ee1d55
 		 * cannot be purged at this moment.  This entry won't be
ee1d55
 		 * referenced any more (so unlinking is safe) since the
ee1d55
-		 * TTL was reset to 0.
ee1d55
+		 * TTL will be reset to 0.
ee1d55
 		 */
ee1d55
 		ISC_LIST_UNLINK(rbtdb->rdatasets[locknum], header, link);
ee1d55
 		size_t header_size = rdataset_size(header);
ee1d55
-- 
ee1d55
2.44.0
ee1d55