From aa887cfa4c64688c57fa79515257aaa368d71845 Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Tue, 6 Apr 2004 00:31:24 +0000
Subject: [PATCH] 1604.   [bug]           A xfrout_ctx_create() failure would
 result in                         xfrout_ctx_destroy() being called with a   
                      partially initialized structure.

---
 CHANGES            |  4 ++++
 bin/named/xfrout.c | 24 +++++++++++++++++-------
 2 files changed, 21 insertions(+), 7 deletions(-)

diff --git a/CHANGES b/CHANGES
index 45bad73eb4..61143acb9c 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+1604.	[bug]		A xfrout_ctx_create() failure would result in
+			xfrout_ctx_destroy() being called with a
+			partially initialized structure.
+			
 1600.	[placeholder]	rt10861.
 
 1599.	[placeholder]	rt10861.
diff --git a/bin/named/xfrout.c b/bin/named/xfrout.c
index fb2cb2246e..bbc4ce1aff 100644
--- a/bin/named/xfrout.c
+++ b/bin/named/xfrout.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: xfrout.c,v 1.115 2004/03/05 04:57:49 marka Exp $ */
+/* $Id: xfrout.c,v 1.115.18.1 2004/04/06 00:31:24 marka Exp $ */
 
 #include <config.h>
 
@@ -1142,8 +1142,6 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 				&xfr));
 	xfr->mnemonic = mnemonic;
 	stream = NULL;
-	db = NULL;
-	ver = NULL;
 	quota = NULL;
 
 	CHECK(xfr->stream->methods->first(xfr->stream));
@@ -1225,10 +1223,10 @@ xfrout_ctx_create(isc_mem_t *mctx, ns_client_t *client, unsigned int id,
 	xfr->qname = qname;
 	xfr->qtype = qtype;
 	xfr->qclass = qclass;
-	xfr->db = db;
-	xfr->ver = ver;
-	xfr->quota = quota;
-	xfr->stream = stream;
+	xfr->db = NULL;
+	xfr->ver = NULL;
+	dns_db_attach(db, &xfr->db);
+	dns_db_attachversion(db, ver, &xfr->ver);
 	xfr->end_of_stream = ISC_FALSE;
 	xfr->tsigkey = tsigkey;
 	xfr->lasttsig = lasttsig;
@@ -1239,6 +1237,12 @@ xfrout_ctx_create(isc_mem_t *mctx, ns_client_t *client, unsigned int id,
 	xfr->sends = 0;
 	xfr->shuttingdown = ISC_FALSE;
 	xfr->mnemonic = NULL;
+	xfr->buf.base = NULL;
+	xfr->buf.length = 0;
+	xfr->txmem = NULL;
+	xfr->txmemlen = 0;
+	xfr->stream = NULL;
+	xfr->quota = NULL;
 
 	/*
 	 * Allocate a temporary buffer for the uncompressed response
@@ -1283,6 +1287,12 @@ xfrout_ctx_create(isc_mem_t *mctx, ns_client_t *client, unsigned int id,
 	 */
 	xfr->client->shutdown = xfrout_client_shutdown;
 	xfr->client->shutdown_arg = xfr;
+	/*
+	 * These MUST be after the last "goto failure;" / CHECK to
+	 * prevent a double free by the caller.
+	 */
+	xfr->quota = quota;
+	xfr->stream = stream;
 
 	*xfrp = xfr;
 	return (ISC_R_SUCCESS);