rpms
/
bind
7
0
Fork 1
Code Issues Pull Requests Releases Activity

Fix two issues 

- dlz_dlopen driver could return the wrong error leading to a segfault (#1052781)
- Fix race condition when freeing fetch object (ISC-Bugs #35385)

Signed-off-by: Tomas Hozza <thozza@redhat.com>
This commit is contained in:
Tomas Hozza 2014-03-05 14:37:50 +01:00
parent 7ebf9a3e72
commit 230113feee
3 changed files with 88 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
bind-99-ISC-Bugs-35385.patch Normal file
View File

@ -0,0 +1,39 @@
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 7023a82..d7f817c 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -351,6 +351,7 @@ typedef struct {
struct dns_fetch {
unsigned int magic;
+ isc_mem_t * mctx;
fetchctx_t * private;
};
@@ -8416,6 +8417,8 @@ dns_resolver_createfetch2(dns_resolver_t *res, dns_name_t *name,
fetch = isc_mem_get(res->mctx, sizeof(*fetch));
if (fetch == NULL)
return (ISC_R_NOMEMORY);
+ fetch->mctx = NULL;
+ isc_mem_attach(res->mctx, &fetch->mctx);
bucketnum = dns_name_fullhash(name, ISC_FALSE) % res->nbuckets;
@@ -8506,7 +8509,7 @@ dns_resolver_createfetch2(dns_resolver_t *res, dns_name_t *name,
FTRACE("created");
*fetchp = fetch;
} else
- isc_mem_put(res->mctx, fetch, sizeof(*fetch));
+ isc_mem_putanddetach(&fetch->mctx, fetch, sizeof(*fetch));
return (result);
}
@@ -8597,7 +8600,7 @@ dns_resolver_destroyfetch(dns_fetch_t **fetchp) {
UNLOCK(&res->buckets[bucketnum].lock);
- isc_mem_put(res->mctx, fetch, sizeof(*fetch));
+ isc_mem_putanddetach(&fetch->mctx, fetch, sizeof(*fetch));
*fetchp = NULL;
if (bucket_empty)

38
bind-99-ISC-Bugs-35495.patch Normal file
View File

@ -0,0 +1,38 @@
From 576f2f19067c0c974d1d39f92c51e5f3a08fc17f Mon Sep 17 00:00:00 2001
From: Tomas Hozza <thozza@redhat.com>
Date: Tue, 4 Mar 2014 16:34:21 +0100
Subject: [PATCH] Return ISC_R_FAILURE if the API version check fails
Signed-off-by: Tomas Hozza <thozza@redhat.com>
---
bin/named/unix/dlz_dlopen_driver.c | 1 +
bin/named/win32/dlz_dlopen_driver.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/bin/named/unix/dlz_dlopen_driver.c b/bin/named/unix/dlz_dlopen_driver.c
index 2ba8a02..62b6614 100644
--- a/bin/named/unix/dlz_dlopen_driver.c
+++ b/bin/named/unix/dlz_dlopen_driver.c
@@ -330,6 +330,7 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
"dlz_dlopen: incorrect version %d "
"should be %d in '%s'",
cd->version, DLZ_DLOPEN_VERSION, cd->dl_path);
+ result = ISC_R_FAILURE;
goto failed;
}
diff --git a/bin/named/win32/dlz_dlopen_driver.c b/bin/named/win32/dlz_dlopen_driver.c
index 0c192b4..62008c0 100644
--- a/bin/named/win32/dlz_dlopen_driver.c
+++ b/bin/named/win32/dlz_dlopen_driver.c
@@ -314,6 +314,7 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
"dlz_dlopen: incorrect version %d "
"should be %d in '%s'",
cd->version, DLZ_DLOPEN_VERSION, cd->dl_path);
+ result = ISC_R_FAILURE;
goto failed;
}
--
1.8.5.3

12
bind.spec
View File

@ -30,7 +30,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
Name: bind
License: ISC
Version: 9.9.5
Release: 1%{?PATCHVER}%{?PREVER}%{?dist}
Release: 2%{?PATCHVER}%{?PREVER}%{?dist}
Epoch: 32
Url: http://www.isc.org/products/BIND/
Buildroot:%{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@ -89,6 +89,10 @@ Patch134:bind97-rh669163.patch
Patch137:bind99-rrl.patch
# Install dns/update.h header for bind-dyndb-ldap plugin
Patch138:bind-9.9.3-include-update-h.patch
# [ISC-Bugs #35495]
Patch139:bind-99-ISC-Bugs-35495.patch
# [ISC-Bugs #35385]
Patch140:bind-99-ISC-Bugs-35385.patch
# SDB patches
Patch11: bind-9.3.2b2-sdbsrc.patch
@ -302,6 +306,8 @@ popd
%patch131 -p1 -b .multlib-conflict
%patch137 -p1 -b .rrl
%patch138 -p1 -b .update
%patch139 -p1 -b .dlz_segfault
%patch140 -p1 -b .fetch_race_cond
%if %{SDB}
%patch101 -p1 -b .old-api
@ -930,6 +936,10 @@ rm -rf ${RPM_BUILD_ROOT}
%endif
%changelog
* Wed Mar 05 2014 Tomas Hozza <thozza@redhat.tom> 32:9.9.5-2
- dlz_dlopen driver could return the wrong error leading to a segfault (#1052781)
- Fix race condition when freeing fetch object (ISC-Bugs #35385)
* Thu Feb 13 2014 Tomas Hozza <thozza@redhat.com> 32:9.9.5-1
- Update to 9.9.5 stable