DLZ crash bug with zone subdelegated elswhere (with fix)

I have been using DLZ for about 4 years now, with no problems on bind 9.3

Recently I moved to bind 9.4 and we started seeing occasional named
crashes due to an assertion error.  I traced this down to queries of
type ANY for a subdomain that is delegated outside the zone.  Someone
else reported this same problem, and there is a detailed explanation of
the zone setup that will cause this here:

http://osdir.com/ml/network.dns.bind9.dlz/2007-08/msg00003.html

I can reliably crash named by doing a query of type ANY for
test.example.com with DNSSEC enabled in the query.

when named gets this query, it crashes as follows:

15-Jan-2009 03:27:43.494 zone_maintenance: zone id.server/CH: enter
15-Jan-2009 03:27:56.556 client 208.180.24.157#49870: UDP request
15-Jan-2009 03:27:56.556 client 208.180.24.157#49870: using view '_default'
15-Jan-2009 03:27:56.556 client 208.180.24.157#49870: request is not signed
15-Jan-2009 03:27:56.556 client 208.180.24.157#49870: recursion not
available
15-Jan-2009 03:27:56.556 client 208.180.24.157#49870: query
15-Jan-2009 03:27:56.556 client 208.180.24.157#49870: query:
test.example.com IN ANY -E
15-Jan-2009 03:27:56.557 rdataset.c:98: REQUIRE(rdataset->methods !=
((void *)0)) failed
15-Jan-2009 03:27:56.557 exiting (due to assertion failure)

backtrace:

#0  0x285042c7 in kill () from /lib/libc.so.7
#1  0x28504226 in raise () from /lib/libc.so.7
#2  0x28502e3a in abort () from /lib/libc.so.7
#3  0x0805902d in assertion_failed (file=0x81b749c "rdataset.c",
line=98, type=isc_assertiontype_require,·
    cond=0x81b74e8 "rdataset->methods != ((void *)0)") at ./main.c:161
#4  0x081133c5 in dns_rdataset_disassociate (rdataset=0x285188f8) at
rdataset.c:98
#5  0x0812bcd6 in find (db=0x8246180, name=0x8212120, version=0x81d21fc,
type=255, options=8, now=1231990076, nodep=0xbfbfdfe0,·
    foundname=0x82123c0, rdataset=0x8231000, sigrdataset=0x82310c0) at
sdlz.c:845
#6  0x0805e8b2 in query_find (client=0x8239000, event=0x0, qtype=255) at
query.c:3558
#7  0x08061464 in ns_query_start (client=0x8239000) at query.c:4626
#8  0x08050bca in client_request (task=0x821c478, event=0x82370e8) at
client.c:1750
#9  0x0818a310 in isc__taskmgr_dispatch () at task.c:867
#10 0x0818d21f in evloop () at app.c:358
#11 0x0818d4b5 in isc_app_run () at app.c:550
#12 0x080597d8 in main (argc=0, argv=0xbfbfebf8) at ./main.c:903

On line 845 of sdlz.c.  Its calling
dns_rdataset_disassociate(sigrdataset) without checking if its actually
associated.  I added a check by calling dns_rdataset_isassociated().
The attached patch fixes the problem and stops named from crashing when
processing these queries.  Not sure if thats really the right thing to
do, but it seems logical from my limited understanding of bind
internals, and it does stop the crashes :).

I really wasn't sure where to send this since DLZ is now
merged into bind itself, and bind's bug database is closed to the public.

Regards,
Michael Schout

------------------------------------------------------------------------------
This SF.net email is sponsored by:
SourcForge Community
SourceForge wants to tell your story.
http://p.sf.net/sfu/sf-spreadtheword

_______________________________________________
Bind-dlz-testers mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bind-dlz-testers

--- lib/dns/sdlz.c.orig	2009-01-15 04:08:36.680365737 +0000
+++ lib/dns/sdlz.c	2009-01-15 04:43:40.880326986 +0000
@@ -841,7 +841,7 @@
 				{
 					result = DNS_R_ZONECUT;
 					dns_rdataset_disassociate(rdataset);
-					if (sigrdataset != NULL)
+					if (sigrdataset != NULL && dns_rdataset_isassociated(sigrdataset))
 						dns_rdataset_disassociate
 							(sigrdataset);
 				} else