From 789cf538f95acdb5dc11e8a6de9699dda6d577bb Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Sun, 16 Aug 2015 20:28:52 +1000
Subject: [PATCH] address use after free error

(cherry picked from commit 6458ad3ab288bb09e730fd7251083974a9b55af2)
---
 bin/named/lwresd.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/bin/named/lwresd.c b/bin/named/lwresd.c
index 8a9ecb64af..eac3f191f0 100644
--- a/bin/named/lwresd.c
+++ b/bin/named/lwresd.c
@@ -602,7 +602,7 @@ listener_copysock(ns_lwreslistener_t *oldlistener,
 
 static isc_result_t
 listener_startclients(ns_lwreslistener_t *listener) {
-	ns_lwdclientmgr_t *cm;
+	ns_lwdclientmgr_t *cm, *next;
 	unsigned int i;
 	isc_result_t result;
 
@@ -626,6 +626,7 @@ listener_startclients(ns_lwreslistener_t *listener) {
 	LOCK(&listener->lock);
 	cm = ISC_LIST_HEAD(listener->cmgrs);
 	while (cm != NULL) {
+		next = ISC_LIST_NEXT(cm, link);
 		result = ns_lwdclient_startrecv(cm);
 		if (result != ISC_R_SUCCESS)
 			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
@@ -633,7 +634,7 @@ listener_startclients(ns_lwreslistener_t *listener) {
 				      "could not start lwres "
 				      "client handler: %s",
 				      isc_result_totext(result));
-		cm = ISC_LIST_NEXT(cm, link);
+		cm = next;
 	}
 	UNLOCK(&listener->lock);