BUG/MINOR: resolvers: Always init a new resolution's list element

resolv_pick_resolution() allocates a new resolution with pool_zalloc(),
then duplicates the hostname into it. If strdup() fails, the resolution
is released with resolv_free_resolution(), which ends with
LIST_DEL_INIT(&resolution->list). But this list element was not
initialized yet (it's only appended to the wait list once the hostname
was duplicated), so it contains NULL pointers which are dereferenced,
crashing the process instead of reporting the allocation failure.

This can only happen when running out of memory. Let's initialize the
list element with the other fields.

This was introduced in 3.3 by commit 6cf2401ed ("BUG/MEDIUM: resolvers:
Make resolution owns its hostname_dn value"), so this must be backported
wherever this commit was backported (so as far as 2.8).

diff --git a/src/resolvers.c b/src/resolvers.c
index a3091b95d3be5ba8d818f5286a404a518ecc2b25..feca18e59fc2c0fe42d5f5c1e8ad73d9f94e65f9 100644 (file)
--- a/src/resolvers.c
+++ b/src/resolvers.c
@@ -2060,6 +2060,7 @@ static struct resolv_resolution *resolv_pick_resolution(struct resolvers *resolv
                res->last_valid = now_ms;
 
                LIST_INIT(&res->requesters);
+               LIST_INIT(&res->list);
                res->response.answer_tree = EB_ROOT;
                res->response.next = NULL;