bug: isc_radix_remove false INSIST statement

[Tom Sawyer]

Hi,

I find a potential bug exist in isc_radix_remove() .
For now, it's all right because there's no using of this function in
official bind release.
But what I do need to take use of this function ,so it happens.

"INSIST(radix->head == node);"  alway fails because isc_mem_put() make node
become NULL.


--- radix.c 2014-01-28 02:58:24.000000000 +0800
+++ radix.c.copy 2014-04-29 19:07:43.341681158 +0800
@@ -634,12 +634,12 @@
  if (node->r == NULL && node->l == NULL) {
  parent = node->parent;
  _deref_prefix(node->prefix);
- isc_mem_put(radix->mctx, node, sizeof(*node));
  radix->num_active_node--;

  if (parent == NULL) {
  INSIST(radix->head == node);
  radix->head = NULL;
+                      isc_mem_put(radix->mctx, node, sizeof(*node));
  return;
  }

@@ -651,6 +651,7 @@
  parent->l = NULL;
  child = parent->r;
  }
+              isc_mem_put(radix->mctx, node, sizeof(*node));

  if (parent->prefix)
  return;
@@ -682,12 +683,12 @@
  child->parent = parent;

  _deref_prefix(node->prefix);
- isc_mem_put(radix->mctx, node, sizeof(*node));
  radix->num_active_node--;

  if (parent == NULL) {
  INSIST(radix->head == node);
  radix->head = child;
+              isc_mem_put(radix->mctx, node, sizeof(*node));
  return;
  }

@@ -697,6 +698,7 @@
  INSIST(parent->l == node);
  parent->l = child;
  }
+ isc_mem_put(radix->mctx, node, sizeof(*node));
 }

-- 
Best Regards.
Tom Sawyer
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/mailman/private/bind-workers/attachments/20140429/5226e222/attachment.html>