497f76
From 4d73fed57703f561aefd545eda0f3f2c5e69a547 Mon Sep 17 00:00:00 2001
497f76
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
497f76
Date: Tue, 16 Jan 2018 09:50:45 +0100
497f76
Subject: [PATCH] 4858.	[security]	Addresses could be referenced after
497f76
 being freed 			in resolver.c, causing an assertion failure. 
497f76
 		(CVE-2017-3145) [RT #46839]
497f76
497f76
---
497f76
 lib/dns/resolver.c | 37 +++++++++++++++++++++++--------------
497f76
 1 file changed, 23 insertions(+), 14 deletions(-)
497f76
497f76
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
497f76
index 860a792..619646f 100644
497f76
--- a/lib/dns/resolver.c
497f76
+++ b/lib/dns/resolver.c
497f76
@@ -751,7 +751,7 @@ fctx_stoptimer(fetchctx_t *fctx) {
497f76
 	 * cannot fail in that case.
497f76
 	 */
497f76
 	result = isc_timer_reset(fctx->timer, isc_timertype_inactive,
497f76
-				  NULL, NULL, ISC_TRUE);
497f76
+				 NULL, NULL, ISC_TRUE);
497f76
 	if (result != ISC_R_SUCCESS) {
497f76
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
497f76
 				 "isc_timer_reset(): %s",
497f76
@@ -759,7 +759,6 @@ fctx_stoptimer(fetchctx_t *fctx) {
497f76
 	}
497f76
 }
497f76
 
497f76
-
497f76
 static inline isc_result_t
497f76
 fctx_startidletimer(fetchctx_t *fctx, isc_interval_t *interval) {
497f76
 	/*
497f76
@@ -992,7 +991,8 @@ fctx_cleanupfinds(fetchctx_t *fctx) {
497f76
 
497f76
 	for (find = ISC_LIST_HEAD(fctx->finds);
497f76
 	     find != NULL;
497f76
-	     find = next_find) {
497f76
+	     find = next_find)
497f76
+	{
497f76
 		next_find = ISC_LIST_NEXT(find, publink);
497f76
 		ISC_LIST_UNLINK(fctx->finds, find, publink);
497f76
 		dns_adb_destroyfind(&find);
497f76
@@ -1008,7 +1008,8 @@ fctx_cleanupaltfinds(fetchctx_t *fctx) {
497f76
 
497f76
 	for (find = ISC_LIST_HEAD(fctx->altfinds);
497f76
 	     find != NULL;
497f76
-	     find = next_find) {
497f76
+	     find = next_find)
497f76
+	{
497f76
 		next_find = ISC_LIST_NEXT(find, publink);
497f76
 		ISC_LIST_UNLINK(fctx->altfinds, find, publink);
497f76
 		dns_adb_destroyfind(&find);
497f76
@@ -1024,7 +1025,8 @@ fctx_cleanupforwaddrs(fetchctx_t *fctx) {
497f76
 
497f76
 	for (addr = ISC_LIST_HEAD(fctx->forwaddrs);
497f76
 	     addr != NULL;
497f76
-	     addr = next_addr) {
497f76
+	     addr = next_addr)
497f76
+	{
497f76
 		next_addr = ISC_LIST_NEXT(addr, publink);
497f76
 		ISC_LIST_UNLINK(fctx->forwaddrs, addr, publink);
497f76
 		dns_adb_freeaddrinfo(fctx->adb, &addr);
497f76
@@ -1039,7 +1041,8 @@ fctx_cleanupaltaddrs(fetchctx_t *fctx) {
497f76
 
497f76
 	for (addr = ISC_LIST_HEAD(fctx->altaddrs);
497f76
 	     addr != NULL;
497f76
-	     addr = next_addr) {
497f76
+	     addr = next_addr)
497f76
+	{
497f76
 		next_addr = ISC_LIST_NEXT(addr, publink);
497f76
 		ISC_LIST_UNLINK(fctx->altaddrs, addr, publink);
497f76
 		dns_adb_freeaddrinfo(fctx->adb, &addr);
497f76
@@ -1047,14 +1050,18 @@ fctx_cleanupaltaddrs(fetchctx_t *fctx) {
497f76
 }
497f76
 
497f76
 static inline void
497f76
-fctx_stopeverything(fetchctx_t *fctx, isc_boolean_t no_response) {
497f76
-	FCTXTRACE("stopeverything");
497f76
+fctx_stopqueries(fetchctx_t *fctx, isc_boolean_t no_response) {
497f76
+	FCTXTRACE("stopqueries");
497f76
 	fctx_cancelqueries(fctx, no_response);
497f76
+	fctx_stoptimer(fctx);
497f76
+}
497f76
+
497f76
+static inline void
497f76
+fctx_cleanupall(fetchctx_t *fctx) {
497f76
 	fctx_cleanupfinds(fctx);
497f76
 	fctx_cleanupaltfinds(fctx);
497f76
 	fctx_cleanupforwaddrs(fctx);
497f76
 	fctx_cleanupaltaddrs(fctx);
497f76
-	fctx_stoptimer(fctx);
497f76
 }
497f76
 
497f76
 static inline void
497f76
@@ -1184,7 +1191,8 @@ fctx_done(fetchctx_t *fctx, isc_result_t result, int line) {
497f76
 		no_response = ISC_FALSE;
497f76
 
497f76
 	fctx->reason = NULL;
497f76
-	fctx_stopeverything(fctx, no_response);
497f76
+
497f76
+	fctx_stopqueries(fctx, no_response);
497f76
 
497f76
 	LOCK(&res->buckets[fctx->bucketnum].lock);
497f76
 
497f76
@@ -3336,11 +3344,12 @@ fctx_doshutdown(isc_task_t *task, isc_event_t *event) {
497f76
 		dns_resolver_cancelfetch(fctx->nsfetch);
497f76
 
497f76
 	/*
497f76
-	 * Shut down anything that is still running on behalf of this
497f76
-	 * fetch.  To avoid deadlock with the ADB, we must do this
497f76
-	 * before we lock the bucket lock.
497f76
+	 * Shut down anything still running on behalf of this
497f76
+	 * fetch, and clean up finds and addresses.  To avoid deadlock
497f76
+	 * with the ADB, we must do this before we lock the bucket lock.
497f76
 	 */
497f76
-	fctx_stopeverything(fctx, ISC_FALSE);
497f76
+	fctx_stopqueries(fctx, ISC_FALSE);
497f76
+	fctx_cleanupall(fctx);
497f76
 
497f76
 	LOCK(&res->buckets[bucketnum].lock);
497f76
 
497f76
-- 
497f76
2.14.3
497f76