From 77be1f07882289b98b24a709298d87153a026928 Mon Sep 17 00:00:00 2001 From: Christopher Faulet Date: Tue, 29 Sep 2026 09:29:21 +0200 Subject: [PATCH] BUG/MINOR: resolvers: Always init a new resolution's list element resolv_pick_resolution() allocates a new resolution with pool_zalloc(), then duplicates the hostname into it. If strdup() fails, the resolution is released with resolv_free_resolution(), which ends with LIST_DEL_INIT(&resolution->list). But this list element was not initialized yet (it's only appended to the wait list once the hostname was duplicated), so it contains NULL pointers which are dereferenced, crashing the process instead of reporting the allocation failure. This can only happen when running out of memory. Let's initialize the list element with the other fields. This was introduced in 3.3 by commit 6cf2401ed ("BUG/MEDIUM: resolvers: Make resolution owns its hostname_dn value"), so this must be backported wherever this commit was backported (so as far as 2.8). --- src/resolvers.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/resolvers.c b/src/resolvers.c index a3091b95d..feca18e59 100644 --- a/src/resolvers.c +++ b/src/resolvers.c @@ -2060,6 +2060,7 @@ static struct resolv_resolution *resolv_pick_resolution(struct resolvers *resolv res->last_valid = now_ms; LIST_INIT(&res->requesters); + LIST_INIT(&res->list); res->response.answer_tree = EB_ROOT; res->response.next = NULL; -- 2.47.3