41 lines
1.5 KiB
Diff
41 lines
1.5 KiB
Diff
From 8baf04a6588bd392f606a3d55b0711cdd00b4b80 Mon Sep 17 00:00:00 2001
|
|
From: Yu Watanabe <watanabe.yu+github@gmail.com>
|
|
Date: Sat, 5 Feb 2022 21:37:01 +0900
|
|
Subject: [PATCH] resolve: fix potential memleak and use-after-free
|
|
|
|
When stub stream is closed early, then queries associated to the stream
|
|
are freed. Previously, the timer event source for queries may not be
|
|
disabled, hence may be triggered with already freed query.
|
|
See also dns_stub_stream_complete().
|
|
|
|
Note that we usually not set NULL or zero when freeing simple objects.
|
|
But, here DnsQuery is large and complicated object, and the element may
|
|
be referenced in subsequent freeing process in the future. Hence, for
|
|
safety, let's set NULL to the pointer.
|
|
|
|
(cherry picked from commit 73bfd7be042cc63e7649242b377ad494bf74ea4b)
|
|
(cherry picked from commit d82bd80cf4e7659906a502735b20a45964b55a88)
|
|
|
|
Conflict:NA
|
|
Reference:https://github.com/systemd/systemd/commit/8baf04a6588bd392f606a3d55b0711cdd00b4b80
|
|
---
|
|
src/resolve/resolved-dns-query.c | 2 ++
|
|
1 file changed, 2 insertions(+)
|
|
|
|
diff --git a/src/resolve/resolved-dns-query.c b/src/resolve/resolved-dns-query.c
|
|
index 7f341986d9..6d372395fe 100644
|
|
--- a/src/resolve/resolved-dns-query.c
|
|
+++ b/src/resolve/resolved-dns-query.c
|
|
@@ -381,6 +381,8 @@ DnsQuery *dns_query_free(DnsQuery *q) {
|
|
if (!q)
|
|
return NULL;
|
|
|
|
+ q->timeout_event_source = sd_event_source_disable_unref(q->timeout_event_source);
|
|
+
|
|
while (q->auxiliary_queries)
|
|
dns_query_free(q->auxiliary_queries);
|
|
|
|
--
|
|
2.33.0
|
|
|