From 014cc821bacf8aab1754bd377582427b9812846b Mon Sep 17 00:00:00 2001
From: Wouter Wijngaards <wouter@nlnetlabs.nl>
Date: Mon, 4 Aug 2008 12:15:12 +0000
Subject: [PATCH] Fix bug #201

git-svn-id: file:///svn/unbound/trunk@1173 be551aaa-1e26-0410-a405-d3ace91eadb9
---
 doc/Changelog              |  1 +
 services/outside_network.c | 20 +++++++++++++++++++-
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/doc/Changelog b/doc/Changelog
index ed11fc7a6..b90fb75e9 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,6 +1,7 @@
 4 August 2008: Wouter
 	- iana port update. 
 	- TODO update.
+	- fix bug 201: null ptr deref on cleanup while udp pkts wait for port.
 
 30 July 2008: Wouter
 	- fixup bug qtype DS for unsigned zone and signed parent validation.
diff --git a/services/outside_network.c b/services/outside_network.c
index 9b1cf8159..c15d38425 100644
--- a/services/outside_network.c
+++ b/services/outside_network.c
@@ -668,6 +668,23 @@ pending_delete(struct outside_network* outnet, struct pending* p)
 {
 	if(!p)
 		return;
+	if(outnet && outnet->udp_wait_first &&
+		(p->next_waiting || p == outnet->udp_wait_last) ) {
+		/* delete from waiting list, if it is in the waiting list */
+		struct pending* prev = NULL, *x = outnet->udp_wait_first;
+		while(x && x != p) {
+			prev = x;
+			x = x->next_waiting;
+		}
+		if(x) {
+			log_assert(x == p);
+			if(prev)
+				prev->next_waiting = p->next_waiting;
+			else	outnet->udp_wait_first = p->next_waiting;
+			if(outnet->udp_wait_last == p)
+				outnet->udp_wait_last = prev;
+		}
+	}
 	if(outnet) {
 		(void)rbtree_delete(outnet->pending, p->node.key);
 	}
@@ -1067,7 +1084,8 @@ serviced_delete(struct serviced_query* sq)
 		if(sq->status == serviced_query_UDP_EDNS ||
 			sq->status == serviced_query_UDP) {
 			struct pending* p = (struct pending*)sq->pending;
-			portcomm_loweruse(sq->outnet, p->pc);
+			if(p->pc)
+				portcomm_loweruse(sq->outnet, p->pc);
 			pending_delete(sq->outnet, p);
 			outnet_send_wait_udp(sq->outnet);
 		} else {