From 3cd4668988c5bccd59cca899459df4cfa985be67 Mon Sep 17 00:00:00 2001
From: Bob Halley <source@isc.org>
Date: Tue, 16 Nov 1999 21:05:09 +0000
Subject: [PATCH] In tcp_recv(), free the event before calling destroy(), since
 the event is a statically allocated part of the tcpmsg.

---
 lib/dns/dispatch.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
index 8d2643befe..3b195ac168 100644
--- a/lib/dns/dispatch.c
+++ b/lib/dns/dispatch.c
@@ -585,6 +585,8 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in)
 
 	(void)task;  /* shut up compiler */
 
+	REQUIRE(VALID_DISPATCH(disp));
+
 	XDEBUG(("Got TCP packet!\n"));
 
 	LOCK(&disp->lock);
@@ -612,10 +614,16 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in)
 
 		UNLOCK(&disp->lock);
 
+		/*
+		 * The event is statically allocated in the tcpmsg	
+		 * structure, and destroy() frees the tcpmsg, so we must
+		 * free the event *before* calling destroy().
+		 */
+		isc_event_free(&ev_in);
+
 		if (killit)
 			destroy(disp);
 
-		isc_event_free(&ev_in);
 		return;
 
 	default:
@@ -983,7 +991,7 @@ dns_dispatch_detach(dns_dispatch_t **dispp)
 			killit = ISC_TRUE;
 	}
 
-	XDEBUG(("dns_dispatch_destory:  refcount = %d\n", disp->refcount));
+	XDEBUG(("dns_dispatch_detach:  refcount = %d\n", disp->refcount));
 
 	UNLOCK(&disp->lock);