upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-05-27 12:13:20 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Tidy up cleanup path in check_signer()

Browse source 
The cloned signature rdataset was not disassociated on the early
return taken when dns_dnssec_keyfromrdata() fails to parse the DNSKEY
public-key data.  In every current caller val->sigrdataset reaches
check_signer() rdatalist-backed, so dns_rdataset_clone() copies the
struct without taking any reference and dns_rdataset_disassociate()
is a no-op -- no memory is actually leaked today.  Hoist the key
parse out of the per-RRSIG loop and let the function fall through
to a single cleanup path, so the parse and the iteration cannot
diverge again.

Assisted-by: Claude:claude-opus-4-7
This commit is contained in:
Ondřej Surý 2026-04-10 18:25:18 +02:00
parent a812bc52eb
commit 19f44a0aa3
No known key found for this signature in database
GPG key ID: 2820F37E873DEA41
1 changed files with 9 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
lib/dns/validator.c
View file

@ -1970,6 +1970,13 @@ check_signer(dns_validator_t *val, dns_rdata_t *keyrdata, uint16_t keyid,
dst_key_t *dstkey = NULL;
isc_result_t result;
dns_rdataset_t rdataset = DNS_RDATASET_INIT;
result = dns_dnssec_keyfromrdata(val->name, keyrdata, val->view->mctx,
&dstkey);
if (result != ISC_R_SUCCESS) {
return result;
}
dns_rdataset_clone(val->sigrdataset, &rdataset);
for (result = dns_rdataset_first(&rdataset); result == ISC_R_SUCCESS;
@ -1983,22 +1990,14 @@ check_signer(dns_validator_t *val, dns_rdata_t *keyrdata, uint16_t keyid,
if (keyid != sig.keyid || algorithm != sig.algorithm) {
continue;
}
if (dstkey == NULL) {
result = dns_dnssec_keyfromrdata(
val->name, keyrdata, val->view->mctx, &dstkey);
if (result != ISC_R_SUCCESS) {
return result;
}
}
result = verify(val, dstkey, &rdata, sig.keyid);
if (result == ISC_R_SUCCESS || result == ISC_R_QUOTA) {
break;
}
}
if (dstkey != NULL) {
dst_key_free(&dstkey);
}
dst_key_free(&dstkey);
dns_rdataset_disassociate(&rdataset);
return result;