The callback function can free the @bres_client@ structure! Make sure we

have freed or know the address of everything we need to free before invoking
the callback: otherwise we mess with freed memory, which is bad.

diff --git a/bres-adns.c b/bres-adns.c
index e0a034a..68b919c 100644 (file)
--- a/bres-adns.c
+++ b/bres-adns.c
@@ -254,7 +254,7 @@ static void afterhook(sel_state *s, sel_args *sa, void *p)
   void *c;
   bres_client *rc;
   adns_query q;
-  adns_answer *a;
+  adns_answer *a, *aa;
   int e;
   int i;
 
@@ -268,8 +268,8 @@ static void afterhook(sel_state *s, sel_args *sa, void *p)
     else switch (rc->q) {
       case adns_r_addr:
        assert(a->type == adns_r_addr);
-       report(rc, a, a->rrs.addr, a->nrrs, &a->owner, 1);
        xfree(rc->u.name);
+       report(rc, a, a->rrs.addr, a->nrrs, &a->owner, 1);
        free(a);
        break;
       case adns_r_ptr:
@@ -289,8 +289,9 @@ static void afterhook(sel_state *s, sel_args *sa, void *p)
          }
          goto fail;
        match:
-         report(rc, a, &a->rrs.addr[i], 1, rc->a->rrs.str, rc->a->nrrs);
-         free(rc->a);
+         aa = rc->a;
+         report(rc, a, &a->rrs.addr[i], 1, aa->rrs.str, aa->nrrs);
+         free(aa);
          free(a);
        }
        break;
@@ -300,9 +301,9 @@ static void afterhook(sel_state *s, sel_args *sa, void *p)
     continue;
 
   fail:
-    rc->func(0, rc->p);
     if (rc->q == adns_r_addr) xfree(rc->u.name);
     if (rc->a) free(rc->a);
+    rc->func(0, rc->p);
     free(a);
   }
 }