From d7e1013741e3921f0f18246d15ef6f800ada77a2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
Date: Sat, 14 Mar 2026 12:53:29 +0100
Subject: [PATCH] Fix cb_args memory leak in ns_query() error path

Initialize cb_args to NULL and free it in the cleanup path so it
is not leaked when the function fails after allocation.
---
 lib/dns/zone.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 693e048f89..8f6ded6717 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -14261,7 +14261,7 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 	bool reqnsid;
 	uint16_t udpsize = SEND_BUFFER_SIZE;
 	isc_sockaddr_t curraddr, sourceaddr;
-	struct stub_cb_args *cb_args;
+	struct stub_cb_args *cb_args = NULL;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
 	REQUIRE(LOCKED_ZONE(zone));
@@ -14480,6 +14480,9 @@ cleanup:
 	if (stub->zone != NULL) {
 		zone_idetach(&stub->zone);
 	}
+	if (cb_args != NULL) {
+		isc_mem_put(zone->mctx, cb_args, sizeof(*cb_args));
+	}
 	isc_mem_put(stub->mctx, stub, sizeof(*stub));
 	if (message != NULL) {
 		dns_message_detach(&message);