From d508ce4036ce4431b8e6a58697cf890bed6db341 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= Date: Fri, 27 Sep 2019 10:35:49 +0200 Subject: [PATCH] lib/dns/rbtdb.c: Add DbC check to safely dereference rbtdb in rbt_datafixer() --- lib/dns/rbtdb.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c index cef118c5ce..26d0f1a41e 100644 --- a/lib/dns/rbtdb.c +++ b/lib/dns/rbtdb.c @@ -7081,17 +7081,14 @@ rbt_datafixer(dns_rbtnode_t *rbtnode, void *base, size_t filesize, dns_rbtdb_t *rbtdb = (dns_rbtdb_t *) arg; rdatasetheader_t *header; unsigned char *limit = ((unsigned char *) base) + filesize; - unsigned char *p; - size_t size; - unsigned int count; REQUIRE(rbtnode != NULL); + REQUIRE(VALID_RBTDB(rbtdb)); for (header = rbtnode->data; header != NULL; header = header->next) { - p = (unsigned char *) header; - - size = dns_rdataslab_size(p, sizeof(*header)); - count = dns_rdataslab_count(p, sizeof(*header));; + unsigned char *p = (unsigned char *) header; + size_t size = dns_rdataslab_size(p, sizeof(*header)); + unsigned int count = dns_rdataslab_count(p, sizeof(*header));; rbtdb->current_version->records += count; rbtdb->current_version->bytes += size; isc_crc64_update(crc, p, size); @@ -7105,7 +7102,7 @@ rbt_datafixer(dns_rbtnode_t *rbtnode, void *base, size_t filesize, header->node = rbtnode; header->node_is_relative = 0; - if (rbtdb != NULL && RESIGN(header) && + if (RESIGN(header) && (header->resign != 0 || header->resign_lsb != 0)) { int idx = header->node->locknum;