Fix use-after-free of pooled value buffers in bbolt Batch writes

Author: nekohasekai

experimental/cachefile/dns_cache.go

@@ -52,6 +52,10 @@ func (c *CacheFile) LoadDNSCache(transportName string, qName string, qType uint1
 }
 
 func (c *CacheFile) SaveDNSCache(transportName string, qName string, qType uint16, rawMessage []byte, expireAt time.Time) error {
+	value := buf.Get(8 + len(rawMessage))
+	defer buf.Put(value)
+	binary.BigEndian.PutUint64(value[:8], uint64(expireAt.Unix()))
+	copy(value[8:], rawMessage)
 	return c.batch(func(tx *bbolt.Tx) error {
 		bucket, err := c.createBucket(tx, bucketDNSCache)
 		if err != nil {
@@ -65,10 +69,6 @@ func (c *CacheFile) SaveDNSCache(transportName string, qName string, qType uint1
 		binary.BigEndian.PutUint16(key, qType)
 		copy(key[2:], qName)
 		defer buf.Put(key)
-		value := buf.Get(8 + len(rawMessage))
-		defer buf.Put(value)
-		binary.BigEndian.PutUint64(value[:8], uint64(expireAt.Unix()))
-		copy(value[8:], rawMessage)
 		return bucket.Put(key, value)
 	})
 }

experimental/cachefile/rdrc.go

@@ -72,6 +72,9 @@ func (c *CacheFile) LoadRDRC(transportName string, qName string, qType uint16) (
 }
 
 func (c *CacheFile) SaveRDRC(transportName string, qName string, qType uint16) error {
+	expiresAt := buf.Get(8)
+	defer buf.Put(expiresAt)
+	binary.BigEndian.PutUint64(expiresAt, uint64(time.Now().Add(c.rdrcTimeout).Unix()))
 	return c.batch(func(tx *bbolt.Tx) error {
 		bucket, err := c.createBucket(tx, bucketRDRC)
 		if err != nil {
@@ -85,9 +88,6 @@ func (c *CacheFile) SaveRDRC(transportName string, qName string, qType uint16) e
 		binary.BigEndian.PutUint16(key, qType)
 		copy(key[2:], qName)
 		defer buf.Put(key)
-		expiresAt := buf.Get(8)
-		defer buf.Put(expiresAt)
-		binary.BigEndian.PutUint64(expiresAt, uint64(time.Now().Add(c.rdrcTimeout).Unix()))
 		return bucket.Put(key, expiresAt)
 	})
 }