From dc419568d1d0d7b05d532f8f0880bd5ec5a9cbf2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
Date: Sat, 14 Mar 2026 12:53:29 +0100
Subject: [PATCH] Fix cb_args memory leak in ns_query() error path

Initialize cb_args to NULL and free it in the cleanup path so it
is not leaked when the function fails after allocation.

(cherry picked from commit d7e1013741e3921f0f18246d15ef6f800ada77a2)
---
 lib/dns/zone.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 705795d443..2887d09e8c 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -14794,7 +14794,7 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 	bool reqnsid;
 	uint16_t udpsize = SEND_BUFFER_SIZE;
 	isc_sockaddr_t curraddr, sourceaddr;
-	struct stub_cb_args *cb_args;
+	struct stub_cb_args *cb_args = NULL;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
 	REQUIRE(LOCKED_ZONE(zone));
@@ -15016,6 +15016,9 @@ cleanup:
 	if (stub->zone != NULL) {
 		zone_idetach(&stub->zone);
 	}
+	if (cb_args != NULL) {
+		isc_mem_put(zone->mctx, cb_args, sizeof(*cb_args));
+	}
 	isc_mem_put(stub->mctx, stub, sizeof(*stub));
 	if (message != NULL) {
 		dns_message_detach(&message);