From 3afddb6a34ec7be67d5e9f49de1919ac40770d73 Mon Sep 17 00:00:00 2001
From: attilamolnar <attilamolnar@hush.com>
Date: Wed, 21 Aug 2013 16:35:29 +0200
Subject: m_dnsbl Fix possible use-after-free after a rehash

---
 src/modules/m_dnsbl.cpp | 32 +++++++-------------------------
 1 file changed, 7 insertions(+), 25 deletions(-)

(limited to 'src/modules/m_dnsbl.cpp')

diff --git a/src/modules/m_dnsbl.cpp b/src/modules/m_dnsbl.cpp
index 5e02dd0a5..3a9360380 100644
--- a/src/modules/m_dnsbl.cpp
+++ b/src/modules/m_dnsbl.cpp
@@ -27,7 +27,7 @@
 /* $ModDesc: Provides handling of DNS blacklists */
 
 /* Class holding data for a single entry */
-class DNSBLConfEntry
+class DNSBLConfEntry : public refcountbase
 {
 	public:
 		enum EnumBanaction { I_UNKNOWN, I_KILL, I_ZLINE, I_KLINE, I_GLINE, I_MARK };
@@ -51,11 +51,11 @@ class DNSBLResolver : public Resolver
 	std::string theiruid;
 	LocalStringExt& nameExt;
 	LocalIntExt& countExt;
-	DNSBLConfEntry *ConfEntry;
+	reference<DNSBLConfEntry> ConfEntry;
 
  public:
 
-	DNSBLResolver(Module *me, LocalStringExt& match, LocalIntExt& ctr, const std::string &hostname, LocalUser* u, DNSBLConfEntry *conf, bool &cached)
+	DNSBLResolver(Module *me, LocalStringExt& match, LocalIntExt& ctr, const std::string &hostname, LocalUser* u, reference<DNSBLConfEntry> conf, bool &cached)
 		: Resolver(hostname, DNS_QUERY_A, cached, me), theiruid(u->uuid), nameExt(match), countExt(ctr), ConfEntry(conf)
 	{
 	}
@@ -209,7 +209,7 @@ class DNSBLResolver : public Resolver
 
 class ModuleDNSBL : public Module
 {
-	std::vector<DNSBLConfEntry *> DNSBLConfEntries;
+	std::vector<reference<DNSBLConfEntry> > DNSBLConfEntries;
 	LocalStringExt nameExt;
 	LocalIntExt countExt;
 
@@ -243,36 +243,22 @@ class ModuleDNSBL : public Module
 		ServerInstance->Modules->Attach(eventlist, this, sizeof(eventlist)/sizeof(Implementation));
 	}
 
-	virtual ~ModuleDNSBL()
-	{
-		ClearEntries();
-	}
-
 	Version GetVersion()
 	{
 		return Version("Provides handling of DNS blacklists", VF_VENDOR);
 	}
 
-	/** Clear entries and free the mem it was using
-	 */
-	void ClearEntries()
-	{
-		for (std::vector<DNSBLConfEntry *>::iterator i = DNSBLConfEntries.begin(); i != DNSBLConfEntries.end(); i++)
-			delete *i;
-		DNSBLConfEntries.clear();
-	}
-
 	/** Fill our conf vector with data
 	 */
 	void ReadConf()
 	{
-		ClearEntries();
+		DNSBLConfEntries.clear();
 
 		ConfigTagList dnsbls = ServerInstance->Config->ConfTags("dnsbl");
 		for(ConfigIter i = dnsbls.first; i != dnsbls.second; ++i)
 		{
 			ConfigTag* tag = i->second;
-			DNSBLConfEntry *e = new DNSBLConfEntry();
+			reference<DNSBLConfEntry> e = new DNSBLConfEntry();
 
 			e->name = tag->getString("name");
 			e->ident = tag->getString("ident");
@@ -337,11 +323,7 @@ class ModuleDNSBL : public Module
 
 				/* add it, all is ok */
 				DNSBLConfEntries.push_back(e);
-				continue;
 			}
-
-			/* delete and drop it, error somewhere */
-			delete e;
 		}
 	}
 
@@ -420,7 +402,7 @@ class ModuleDNSBL : public Module
 
 		unsigned long total_hits = 0, total_misses = 0;
 
-		for (std::vector<DNSBLConfEntry*>::iterator i = DNSBLConfEntries.begin(); i != DNSBLConfEntries.end(); i++)
+		for (std::vector<reference<DNSBLConfEntry> >::const_iterator i = DNSBLConfEntries.begin(); i != DNSBLConfEntries.end(); ++i)
 		{
 			total_hits += (*i)->stats_hits;
 			total_misses += (*i)->stats_misses;
-- 
cgit v1.2.3