From 8da7fa7b52738e971006afda6b016c3d31804e2c Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Tue, 31 Jan 2017 11:20:03 +1100 Subject: [PATCH] add a REQUIRE to catch the NULL pointer dereference that triggered CVE-2017-3135 (cherry picked from commit 1d8995d226d8bca96b8ba286316018be4b7835f2) --- lib/dns/rdataset.c | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/dns/rdataset.c b/lib/dns/rdataset.c index ab02d32e09..f70dae9984 100644 --- a/lib/dns/rdataset.c +++ b/lib/dns/rdataset.c @@ -337,6 +337,7 @@ towiresorted(dns_rdataset_t *rdataset, const dns_name_t *owner_name, */ REQUIRE(DNS_RDATASET_VALID(rdataset)); + REQUIRE(rdataset->methods != NULL); REQUIRE(countp != NULL); REQUIRE((order == NULL) == (order_arg == NULL)); REQUIRE(cctx != NULL && cctx->mctx != NULL);