BUG/MEDIUM: resolvers: Detach query item on response error

When a new response is parsed, it is unexpected to have an old query item
still attached to the resolution. And indeed, when the response is parsed
and validated, the query item is detached and used for a last check on its
dname. However, this is only true for a valid response. If an error is
detected, the query is not detached. This leads to undefined behavior (most
probably a crash) on the next response because the first element in the
query list is referencing an old response.

This patch must be backported as far as 2.0.
This commit is contained in:
Christopher Faulet 2021-12-01 10:18:08 +01:00
parent 4ab2679689
commit 80b2e34b18

View File

@ -1478,6 +1478,8 @@ static int resolv_validate_dns_response(unsigned char *resp, unsigned char *bufe
cause = RSLV_RESP_INVALID;
return_error:
if (query)
LIST_DEL_INIT(&query->list);
pool_free(resolv_answer_item_pool, answer_record);
return cause;
}