nmathewson/Libevent — pull request #76 by belobrov-andrey (2013-05-06 14:36:44+00:00)
Title: Evdns: checking request nameserver for NULL, before using it.

There is fail scenario for null pointer dereferencing.
1. Initialize libevent using empty nameservers list.
2. Send more then one request using evdns_base_resolve_ipv4.
3. Call evdns_base_free.

Requests are added to the waiting queue with req->ns == NULL.

Following callstack results in access violation:
evdns_base_free_and_unlock
request_finished
evdns_requests_pump_waiting_queue
evdns_request_transmit

at lines:

if (!req->ns)
{
/* unable to transmit request if no nameservers */
return 1;
}

We could also add request with req->ns == NULL to the waiting queue, if we exceed global_requests_inflight. See function request_new:
...
const char issuing_now =
(base->global_requests_inflight < base->global_max_requests_inflight) ? 1 : 0;
...
req->ns = issuing_now ? nameserver_pick(base) : NULL;
...

Proposed patch should fix this issue.