From c03bb27f0675a6e60ceea66b451548e8481bc05c Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Wed, 25 Oct 2000 04:26:57 +0000
Subject: [PATCH]  532.   [func]          Implement DNS UPDATE pseudo records
 using                         DNS_RDATA_UPDATE flag.

 531.   [func]          Rdata really should be initalized before being
                        assigned to (dns_rdata_fromwire(), dns_rdata_fromtext(),
                        dns_rdata_clone(), dns_rdata_fromregion()),
                        check that it is.
---
 CHANGES                      |  8 +++++
 bin/dig/dig.c                |  5 +--
 bin/dig/dighost.c            |  8 +++--
 bin/dig/host.c               |  5 +--
 bin/dig/nslookup.c           |  8 +++--
 bin/dnssec/dnssec-signkey.c  | 10 +++---
 bin/dnssec/dnssec-signzone.c | 22 ++++++------
 bin/named/client.c           |  3 +-
 bin/named/query.c            |  8 +++--
 bin/named/server.c           |  7 ++--
 bin/named/update.c           | 25 ++++++++------
 bin/named/xfrout.c           |  6 ++--
 bin/nsupdate/nsupdate.c      | 18 ++++++----
 lib/dns/a6.c                 |  5 +--
 lib/dns/adb.c                |  7 ++--
 lib/dns/byaddr.c             |  5 +--
 lib/dns/db.c                 |  6 ++--
 lib/dns/dnssec.c             |  8 +++--
 lib/dns/include/dns/rdata.h  |  6 ++--
 lib/dns/journal.c            | 14 ++++----
 lib/dns/lookup.c             |  6 ++--
 lib/dns/master.c             |  6 ++--
 lib/dns/masterdump.c         |  4 +--
 lib/dns/message.c            | 61 ++++++++++++++++++--------------
 lib/dns/ncache.c             | 13 +++----
 lib/dns/nxt.c                |  4 +--
 lib/dns/opt.c                |  4 +--
 lib/dns/rbtdb.c              |  4 +--
 lib/dns/rdata.c              | 67 +++++++++++++++++++++++++++++++++---
 lib/dns/rdatalist.c          |  5 ++-
 lib/dns/rdataset.c           |  8 +++--
 lib/dns/rdataslab.c          | 22 ++++++++----
 lib/dns/resolver.c           | 12 ++++---
 lib/dns/sec/dst/dst_api.c    |  6 ++--
 lib/dns/tsig.c               | 10 +++---
 lib/dns/validator.c          | 20 ++++++-----
 lib/dns/xfrin.c              |  6 ++--
 lib/dns/zone.c               | 20 ++++++-----
 38 files changed, 300 insertions(+), 162 deletions(-)

diff --git a/CHANGES b/CHANGES
index a0c557ad4f..ac73004aba 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,11 @@
+ 532.	[func]		Implement DNS UPDATE pseudo records using
+			DNS_RDATA_UPDATE flag.
+
+ 531.	[func]		Rdata really should be initalized before being
+			assigned to (dns_rdata_fromwire(), dns_rdata_fromtext(),
+			dns_rdata_clone(), dns_rdata_fromregion()),
+			check that it is.
+
  530.	[func]		New function dns_rdata_invalidate().
 
  529.	[bug]		521 contained a bug which caused zones to always
diff --git a/bin/dig/dig.c b/bin/dig/dig.c
index 8e974413c4..86a133acbd 100644
--- a/bin/dig/dig.c
+++ b/bin/dig/dig.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dig.c,v 1.122 2000/10/23 23:13:16 mws Exp $ */
+/* $Id: dig.c,v 1.123 2000/10/25 04:26:12 marka Exp $ */
 
 #include <config.h>
 #include <stdlib.h>
@@ -287,7 +287,7 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags,
 	isc_result_t result, loopresult;
 	dns_name_t empty_name;
 	char t[4096];
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 
 	UNUSED(flags);
 
@@ -314,6 +314,7 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags,
 						     buf);
 				check_result(result, "say_message");
 				loopresult = dns_rdataset_next(rdataset);
+				dns_rdata_invalidate(&rdata);
 			}
 		}
 		result = dns_message_nextname(msg, DNS_SECTION_ANSWER);
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index fb5bf48aba..9aef7f7b34 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dighost.c,v 1.157 2000/10/23 23:13:17 mws Exp $ */
+/* $Id: dighost.c,v 1.158 2000/10/25 04:26:13 marka Exp $ */
 
 /*
  * Notice to programmers:  Do not use this code as an example of how to
@@ -1001,7 +1001,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query,
 	dig_lookup_t *lookup = NULL;
 	dig_server_t *srv = NULL;
 	dns_rdataset_t *rdataset = NULL;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_name_t *name = NULL;
 	isc_result_t result, loopresult;
 	isc_buffer_t *b = NULL;
@@ -1093,6 +1093,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query,
 						 srv, link);
 					isc_buffer_free(&b);
 				}
+				dns_rdata_invalidate(&rdata);
 				loopresult = dns_rdataset_next(rdataset);
 			}
 		}
@@ -2070,7 +2071,7 @@ check_for_more_data(dig_query_t *query, dns_message_t *msg,
 		    isc_socketevent_t *sevent)
 {
 	dns_rdataset_t *rdataset = NULL;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_rdata_soa_t soa;
 	isc_result_t result;
 	isc_buffer_t b;
@@ -2109,6 +2110,7 @@ check_for_more_data(dig_query_t *query, dns_message_t *msg,
 				query->rr_count++;
 				if (query->rr_count >= rr_limit)
 					atlimit = ISC_TRUE;
+				dns_rdata_invalidate(&rdata);
 				dns_rdataset_current(rdataset, &rdata);
 				/*
 				 * If this is the first rr, make sure
diff --git a/bin/dig/host.c b/bin/dig/host.c
index af22cc9308..49075c6134 100644
--- a/bin/dig/host.c
+++ b/bin/dig/host.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: host.c,v 1.57 2000/10/23 23:13:19 mws Exp $ */
+/* $Id: host.c,v 1.58 2000/10/25 04:26:14 marka Exp $ */
 
 #include <config.h>
 #include <stdlib.h>
@@ -288,7 +288,7 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 {
 	dns_name_t *name, *print_name;
 	dns_rdataset_t *rdataset;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	isc_buffer_t target;
 	isc_result_t result, loopresult;
 	isc_region_t r;
@@ -355,6 +355,7 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 						rtt = "unknown";
 					say_message(print_name, rtt,
 						    &rdata, query);
+					dns_rdata_invalidate(&rdata);
 					loopresult =
 						dns_rdataset_next(rdataset);
 				}
diff --git a/bin/dig/nslookup.c b/bin/dig/nslookup.c
index 1cd9b2e602..e3869249a1 100644
--- a/bin/dig/nslookup.c
+++ b/bin/dig/nslookup.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nslookup.c,v 1.60 2000/10/23 23:13:20 mws Exp $ */
+/* $Id: nslookup.c,v 1.61 2000/10/25 04:26:16 marka Exp $ */
 
 #include <config.h>
 
@@ -194,7 +194,7 @@ printsection(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers,
 	isc_buffer_t *b = NULL;
 	dns_name_t *name;
 	dns_rdataset_t *rdataset = NULL;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	char *ptr;
 	char *input;
 
@@ -327,6 +327,7 @@ printsection(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers,
 					       (int)isc_buffer_usedlength(b),
 					       (char*)isc_buffer_base(b));
 				}
+				dns_rdata_invalidate(&rdata);
 				loopresult = dns_rdataset_next(rdataset);
 			}
 		}
@@ -349,7 +350,7 @@ detailsection(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers,
 	isc_buffer_t *b = NULL;
 	dns_name_t *name;
 	dns_rdataset_t *rdataset = NULL;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	char *ptr;
 	char *input;
 
@@ -466,6 +467,7 @@ detailsection(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers,
 					       (int)isc_buffer_usedlength(b),
 					       (char*)isc_buffer_base(b));
 				}
+				dns_rdata_invalidate(&rdata);
 				loopresult = dns_rdataset_next(rdataset);
 			}
 		}
diff --git a/bin/dnssec/dnssec-signkey.c b/bin/dnssec/dnssec-signkey.c
index 76702a6cd9..34493c34cc 100644
--- a/bin/dnssec/dnssec-signkey.c
+++ b/bin/dnssec/dnssec-signkey.c
@@ -17,7 +17,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssec-signkey.c,v 1.39 2000/10/20 02:21:35 marka Exp $ */
+/* $Id: dnssec-signkey.c,v 1.40 2000/10/25 04:26:17 marka Exp $ */
 
 #include <config.h>
 
@@ -97,7 +97,7 @@ usage(void) {
 static void
 loadkeys(dns_name_t *name, dns_rdataset_t *rdataset) {
 	dst_key_t *key;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	keynode_t *keynode;
 	isc_result_t result;
 
@@ -105,6 +105,7 @@ loadkeys(dns_name_t *name, dns_rdataset_t *rdataset) {
 	result = dns_rdataset_first(rdataset);
 	check_result(result, "dns_rdataset_first");
 	for (; result == ISC_R_SUCCESS; result = dns_rdataset_next(rdataset)) {
+		dns_rdata_invalidate(&rdata);
 		dns_rdataset_current(rdataset, &rdata);
 		key = NULL;
 		result = dns_dnssec_keyfromrdata(name, &rdata, mctx, &key);
@@ -155,7 +156,8 @@ main(int argc, char *argv[]) {
 	dns_dbnode_t *node;
 	dns_dbversion_t *version;
 	dst_key_t *key = NULL;
-	dns_rdata_t *rdata, sigrdata;
+	dns_rdata_t *rdata;
+	dns_rdata_t sigrdata = DNS_RDATA_INIT;
 	dns_rdatalist_t sigrdatalist;
 	dns_rdataset_t rdataset, sigrdataset, newsigrdataset;
 	dns_rdata_sig_t sig;
@@ -319,6 +321,7 @@ main(int argc, char *argv[]) {
 			fatal("signature by key '%s' did not verify: %s",
 			      keystr, isc_result_totext(result));
 		}
+		dns_rdata_invalidate(&sigrdata);
 		dns_rdata_freestruct(&sig);
 		result = dns_rdataset_next(&sigrdataset);
 	} while (result == ISC_R_SUCCESS);
@@ -370,7 +373,6 @@ main(int argc, char *argv[]) {
 		data = isc_mem_get(mctx, BUFSIZE);
 		if (data == NULL)
 			fatal("out of memory");
-		dns_rdata_init(rdata);
 		isc_buffer_init(&b, data, BUFSIZE);
 		result = dns_dnssec_sign(domain, &rdataset, key,
 					 &starttime, &endtime,
diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index 5ddca64500..b631d7aac0 100644
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -17,7 +17,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssec-signzone.c,v 1.102 2000/10/20 02:21:36 marka Exp $ */
+/* $Id: dnssec-signzone.c,v 1.103 2000/10/25 04:26:18 marka Exp $ */
 
 #include <config.h>
 
@@ -99,7 +99,6 @@ signwithkey(dns_name_t *name, dns_rdataset_t *rdataset, dns_rdata_t *rdata,
 {
 	isc_result_t result;
 
-	dns_rdata_init(rdata);
 	result = dns_dnssec_sign(name, rdataset, key, &starttime, &endtime,
 				 mctx, b, rdata);
 	isc_entropy_stopcallbacksources(ectx);
@@ -170,7 +169,7 @@ keythatsigned(dns_rdata_sig_t *sig) {
 		key->key = pubkey;
 	key->isdefault = ISC_FALSE;
 	key->position = keycount++;
-	ISC_LIST_APPEND(keylist, key, link);
+	ISC_LIST_APPENDUNSAFE(keylist, key, link);
 	return key;
 }
 
@@ -224,7 +223,7 @@ signset(dns_db_t *db, dns_dbversion_t *version, dns_diff_t *diff,
 	dns_dbnode_t *node, dns_name_t *name, dns_rdataset_t *set)
 {
 	dns_rdataset_t sigset;
-	dns_rdata_t sigrdata;
+	dns_rdata_t sigrdata = DNS_RDATA_INIT;
 	dns_rdata_sig_t sig;
 	signer_key_t *key;
 	isc_result_t result;
@@ -355,7 +354,7 @@ signset(dns_db_t *db, dns_dbversion_t *version, dns_diff_t *diff,
 
 		if (resign) {
 			isc_buffer_t b;
-			dns_rdata_t trdata;
+			dns_rdata_t trdata = DNS_RDATA_INIT;
 			unsigned char array[BUFSIZE];
 			char keystr[KEY_FORMATSIZE];
 
@@ -372,6 +371,7 @@ signset(dns_db_t *db, dns_dbversion_t *version, dns_diff_t *diff,
 			dns_diff_append(diff, &tuple);
 		}
 
+		dns_rdata_invalidate(&sigrdata);
 		dns_rdata_freestruct(&sig);
 		result = dns_rdataset_next(&sigset);
 	}
@@ -386,7 +386,7 @@ signset(dns_db_t *db, dns_dbversion_t *version, dns_diff_t *diff,
 	while (key != NULL) {
 		if (key->isdefault && !nowsignedby[key->position]) {
 			isc_buffer_t b;
-			dns_rdata_t trdata;
+			dns_rdata_t trdata = DNS_RDATA_INIT;
 			unsigned char array[BUFSIZE];
 			char keystr[KEY_FORMATSIZE];
 
@@ -419,6 +419,7 @@ hasnullkey(dns_rdataset_t *rdataset) {
 	while (result == ISC_R_SUCCESS) {
 		dst_key_t *key = NULL;
 
+		dns_rdata_init(&rdata);
 		dns_rdataset_current(rdataset, &rdata);
 		result = dns_dnssec_keyfromrdata(dns_rootname,
 						 &rdata, mctx, &key);
@@ -562,7 +563,7 @@ haschildkey(dns_db_t *db, dns_name_t *name) {
 	dns_db_t *newdb = NULL;
 	dns_dbnode_t *newnode = NULL;
 	dns_rdataset_t set, sigset;
-	dns_rdata_t sigrdata;
+	dns_rdata_t sigrdata = DNS_RDATA_INIT;
 	isc_result_t result;
 	isc_boolean_t found = ISC_FALSE;
 	dns_rdata_sig_t sig;
@@ -605,6 +606,7 @@ haschildkey(dns_db_t *db, dns_name_t *name) {
 			found = ISC_TRUE;
 			break;
 		}
+		dns_rdata_invalidate(&sigrdata);
 	}
 
  failure:
@@ -631,7 +633,7 @@ nxt_setbit(dns_rdataset_t *rdataset, dns_rdatatype_t type) {
 	dns_name_t nxtname;
 	isc_region_t r, r2;
 	isc_result_t result;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 
 	result = dns_rdataset_first(rdataset);
 	check_result(result, "dns_rdataset_first()");
@@ -647,7 +649,7 @@ nxt_setbit(dns_rdataset_t *rdataset, dns_rdatatype_t type) {
 static void
 createnullkey(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name) {
 	unsigned char keydata[4];
-	dns_rdata_t keyrdata;
+	dns_rdata_t keyrdata = DNS_RDATA_INIT;
 	dns_rdata_key_t key;
 	dns_diff_t diff;
 	dns_difftuple_t *tuple = NULL;
@@ -938,7 +940,7 @@ minimumttl(dns_db_t *db, dns_dbversion_t *version) {
 	dns_name_t *origin;
 	dns_fixedname_t fname;
 	dns_name_t *name;
-	dns_rdata_t soarr;
+	dns_rdata_t soarr = DNS_RDATA_INIT;
 	dns_rdata_soa_t soa;
 	isc_result_t result;
 	dns_ttl_t ttl;
diff --git a/bin/named/client.c b/bin/named/client.c
index affdf999d1..c7de659cda 100644
--- a/bin/named/client.c
+++ b/bin/named/client.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: client.c,v 1.122 2000/10/18 22:10:20 gson Exp $ */
+/* $Id: client.c,v 1.123 2000/10/25 04:26:19 marka Exp $ */
 
 #include <config.h>
 
@@ -1010,6 +1010,7 @@ client_addopt(ns_client_t *client) {
 	rdata->length = 0;
 	rdata->rdclass = rdatalist->rdclass;
 	rdata->type = rdatalist->type;
+	rdata->flags = 0;
 
 #ifdef DNS_OPT_NEWCODES
 	/*
diff --git a/bin/named/query.c b/bin/named/query.c
index 0f2c7f5251..2cf67e8c0e 100644
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: query.c,v 1.139 2000/10/20 02:21:39 marka Exp $ */
+/* $Id: query.c,v 1.140 2000/10/25 04:26:21 marka Exp $ */
 
 #include <config.h>
 
@@ -1565,7 +1565,7 @@ query_addsoa(ns_client_t *client, dns_db_t *db, isc_boolean_t zero_ttl) {
 		 * Extract the SOA MINIMUM.
 		 */
 		dns_rdata_soa_t soa;
-		dns_rdata_t rdata;
+		dns_rdata_t rdata = DNS_RDATA_INIT;
 		result = dns_rdataset_first(rdataset);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		dns_rdataset_current(rdataset, &rdata);
@@ -2139,7 +2139,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event) {
 	dns_name_t *fname, *zfname, *tname, *prefix;
 	dns_rdataset_t *rdataset, *trdataset;
 	dns_rdataset_t *sigrdataset, *zrdataset, *zsigrdataset;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_rdatasetiter_t *rdsiter;
 	isc_boolean_t want_restart, authoritative, is_zone;
 	unsigned int qcount, n, nlabels, nbits;
@@ -2728,6 +2728,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event) {
 			goto cleanup;
 		dns_rdataset_current(trdataset, &rdata);
 		result = dns_rdata_tostruct(&rdata, &cname, NULL);
+		dns_rdata_invalidate(&rdata);
 		if (result != ISC_R_SUCCESS)
 			goto cleanup;
 		dns_name_init(tname, NULL);
@@ -2774,6 +2775,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event) {
 			goto cleanup;
 		dns_rdataset_current(trdataset, &rdata);
 		result = dns_rdata_tostruct(&rdata, &dname, NULL);
+		dns_rdata_invalidate(&rdata);
 		if (result != ISC_R_SUCCESS)
 			goto cleanup;
 		dns_name_init(tname, NULL);
diff --git a/bin/named/server.c b/bin/named/server.c
index 6a37f7b315..791ac6ca9b 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: server.c,v 1.231 2000/10/18 22:13:48 bwelling Exp $ */
+/* $Id: server.c,v 1.232 2000/10/25 04:26:22 marka Exp $ */
 
 #include <config.h>
 
@@ -727,7 +727,7 @@ create_version_zone(dns_c_ctx_t *cctx, dns_zonemgr_t *zmgr, dns_view_t *view)
 	unsigned char buf[256];
 	isc_region_t r;
 	size_t len;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	static unsigned char origindata[] = "\007version\004bind";
 	dns_name_t origin;
 
@@ -810,7 +810,7 @@ create_authors_zone(dns_zonemgr_t *zmgr, dns_view_t *view) {
 	dns_diff_t diff;
 	isc_constregion_t r;
 	isc_constregion_t cr;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	static const char origindata[] = "\007authors\004bind";
 	dns_name_t origin;
 	int i;
@@ -856,6 +856,7 @@ create_authors_zone(dns_zonemgr_t *zmgr, dns_view_t *view) {
 		CHECK(dns_difftuple_create(ns_g_mctx, DNS_DIFFOP_ADD, &origin,
 					   0, &rdata, &tuple));
 		dns_diff_append(&diff, &tuple);
+		dns_rdata_invalidate(&rdata);
 	}
 
 	CHECK(dns_diff_apply(&diff, db, dbver));
diff --git a/bin/named/update.c b/bin/named/update.c
index e0e40b930e..be20ffd6ba 100644
--- a/bin/named/update.c
+++ b/bin/named/update.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: update.c,v 1.69 2000/10/20 22:34:50 gson Exp $ */
+/* $Id: update.c,v 1.70 2000/10/25 04:26:23 marka Exp $ */
 
 #include <config.h>
 
@@ -266,7 +266,8 @@ foreach_node_rr_action(void *data, dns_rdataset_t *rdataset) {
 	     result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(rdataset))
 	{
-		rr_t rr;
+		rr_t rr = { 0, DNS_RDATA_INIT };
+		
 		dns_rdataset_current(rdataset, &rr.rdata);
 		rr.ttl = rdataset->ttl;
 		result = (*ctx->rr_action)(ctx->rr_action_data, &rr);
@@ -407,7 +408,7 @@ foreach_rr(dns_db_t *db,
 	     result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(&rdataset))
 	{
-		rr_t rr;
+		rr_t rr = { 0, DNS_RDATA_INIT };
 		dns_rdataset_current(&rdataset, &rr.rdata);
 		rr.ttl = rdataset.ttl;
 		result = (*rr_action)(rr_action_data, &rr);
@@ -807,7 +808,7 @@ temp_check(isc_mem_t *mctx, dns_diff_t *temp, dns_db_t *db,
 			     result == ISC_R_SUCCESS;
 			     result = dns_rdataset_next(&rdataset))
 			{
-				dns_rdata_t rdata;
+				dns_rdata_t rdata = DNS_RDATA_INIT;
 				dns_rdataset_current(&rdataset, &rdata);
 				result = temp_append(&d_rrs, name, &rdata);
 				if (result != ISC_R_SUCCESS)
@@ -1144,7 +1145,8 @@ static isc_result_t
 namelist_append_name(dns_diff_t *list, dns_name_t *name) {
 	isc_result_t result;
 	dns_difftuple_t *tuple = NULL;
-	static dns_rdata_t dummy_rdata = { NULL, 0, 0, 0, 0, { NULL, NULL } };
+	static dns_rdata_t dummy_rdata = { NULL, 0, 0, 0, 0,
+					   { (void*)(-1), (void*)(-1) } };
 	CHECK(dns_difftuple_create(list->mctx, DNS_DIFFOP_EXISTS, name, 0,
 				   &dummy_rdata, &tuple));
 	dns_diff_append(list, &tuple);
@@ -1344,7 +1346,7 @@ add_nxt(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, dns_diff_t *diff)
 	isc_result_t result;
 	dns_dbnode_t *node = NULL;
 	unsigned char buffer[DNS_NXT_BUFFERSIZE];
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_difftuple_t *tuple = NULL;
 	dns_fixedname_t fixedname;
 	dns_name_t *target;
@@ -1391,7 +1393,7 @@ add_placeholder_nxt(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 	dns_difftuple_t *tuple = NULL;
 	isc_region_t r;
 	unsigned char data[1] = { 0 }; /* The root domain, no bits. */
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 
 	r.base = data;
 	r.length = sizeof data;
@@ -1430,7 +1432,7 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 	isc_result_t result;
 	dns_dbnode_t *node = NULL;
 	dns_rdataset_t rdataset;
-	dns_rdata_t sig_rdata;
+	dns_rdata_t sig_rdata = DNS_RDATA_INIT;
 	isc_buffer_t buffer;
 	unsigned char data[1024]; /* XXX */
 	unsigned int i;
@@ -1455,6 +1457,7 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 		/* XXX inefficient - will cause dataset merging */
 		CHECK(update_one_rr(db, ver, diff, DNS_DIFFOP_ADD, name,
 				    rdataset.ttl, &sig_rdata));
+		dns_rdata_invalidate(&sig_rdata);
 	}
 
  failure:
@@ -1951,7 +1954,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	     result = dns_message_nextname(request, DNS_SECTION_PREREQUISITE))
 	{
 		dns_name_t *name = NULL;
-		dns_rdata_t rdata;
+		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_ttl_t ttl;
 		dns_rdataclass_t update_class;
 		isc_boolean_t flag;
@@ -2060,7 +2063,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	     result = dns_message_nextname(request, DNS_SECTION_UPDATE))
 	{
 		dns_name_t *name = NULL;
-		dns_rdata_t rdata;
+		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_ttl_t ttl;
 		dns_rdataclass_t update_class;
 		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass,
@@ -2145,7 +2148,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	     result = dns_message_nextname(request, DNS_SECTION_UPDATE))
 	{
 		dns_name_t *name = NULL;
-		dns_rdata_t rdata;
+		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_ttl_t ttl;
 		dns_rdataclass_t update_class;
 		isc_boolean_t flag;
diff --git a/bin/named/xfrout.c b/bin/named/xfrout.c
index 9429d95624..c3fe2a1fb7 100644
--- a/bin/named/xfrout.c
+++ b/bin/named/xfrout.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: xfrout.c,v 1.78 2000/10/20 13:29:30 marka Exp $ */
+/* $Id: xfrout.c,v 1.79 2000/10/25 04:26:25 marka Exp $ */
 
 #include <config.h>
 
@@ -138,6 +138,7 @@ db_rr_iterator_init(db_rr_iterator_t *it, dns_db_t *db, dns_dbversion_t *ver,
 	if (result != ISC_R_SUCCESS)
 		return (result);
 	it->rdatasetit = NULL;
+	dns_rdata_init(&it->rdata);
 	dns_rdataset_init(&it->rdataset);
 	dns_fixedname_init(&it->fixedname);
 	INSIST(! dns_rdataset_isassociated(&it->rdataset));
@@ -240,6 +241,7 @@ db_rr_iterator_current(db_rr_iterator_t *it, dns_name_t **name,
 	REQUIRE(it->result == ISC_R_SUCCESS);
 	*name = dns_fixedname_name(&it->fixedname);
 	*ttl = it->rdataset.ttl;
+	dns_rdata_invalidate(&it->rdata);
 	dns_rdataset_current(&it->rdataset, &it->rdata);
 	*rdata = &it->rdata;
 }
@@ -816,7 +818,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 	dns_difftuple_t *current_soa_tuple = NULL;
 	dns_name_t *soa_name;
 	dns_rdataset_t *soa_rdataset;
-	dns_rdata_t soa_rdata;
+	dns_rdata_t soa_rdata = DNS_RDATA_INIT;
 	isc_boolean_t have_soa = ISC_FALSE;
 	const char *mnemonic = NULL;
 	isc_mem_t *mctx = client->mctx;
diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
index 566bf35bf9..7e9e8e40c8 100644
--- a/bin/nsupdate/nsupdate.c
+++ b/bin/nsupdate/nsupdate.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nsupdate.c,v 1.57 2000/10/20 18:31:27 gson Exp $ */
+/* $Id: nsupdate.c,v 1.58 2000/10/25 04:26:26 marka Exp $ */
 
 #include <config.h>
 
@@ -585,7 +585,7 @@ parse_name(char **cmdlinep, dns_message_t *msg, dns_name_t **namep) {
 static isc_uint16_t
 parse_rdata(char **cmdlinep, dns_rdataclass_t rdataclass,
 	    dns_rdatatype_t rdatatype, dns_message_t *msg,
-	    dns_rdata_t **rdatap)
+	    dns_rdata_t *rdata)
 {
 	char *cmdline = *cmdlinep;
 	isc_buffer_t source, *buf = NULL;
@@ -620,7 +620,7 @@ parse_rdata(char **cmdlinep, dns_rdataclass_t rdataclass,
 			}
 			result = isc_buffer_allocate(mctx, &buf, bufsz);
 			check_result(result, "isc_buffer_allocate");
-			result = dns_rdata_fromtext(*rdatap, rdataclass,
+			result = dns_rdata_fromtext(rdata, rdataclass,
 						    rdatatype,
 						    lex, rn, ISC_FALSE, buf,
 						    &callbacks);
@@ -631,6 +631,8 @@ parse_rdata(char **cmdlinep, dns_rdataclass_t rdataclass,
 		dns_message_takebuffer(msg, &buf);
 		if (result != ISC_R_SUCCESS)
 			return (STATUS_MORE);
+	} else {
+		rdata->flags = DNS_RDATA_UPDATE;
 	}
 	*cmdlinep = cmdline;
 	return (STATUS_MORE);
@@ -701,7 +703,7 @@ make_prereq(char *cmdline, isc_boolean_t ispositive, isc_boolean_t isrrset) {
 
 	if (isrrset && ispositive) {
 		retval = parse_rdata(&cmdline, rdataclass, rdatatype,
-				     updatemsg, &rdata);
+				     updatemsg, rdata);
 		if (retval != STATUS_MORE)
 			return (retval);
 	}
@@ -895,6 +897,7 @@ update_addordelete(char *cmdline, isc_boolean_t isdelete) {
 		if (isdelete) {
 			rdataclass = dns_rdataclass_any;
 			rdatatype = dns_rdatatype_any;
+			rdata->flags = DNS_RDATA_UPDATE;
 			goto doneparsing;
 		} else {
 			fprintf(stderr, "failed to read class or type\n");
@@ -913,6 +916,7 @@ update_addordelete(char *cmdline, isc_boolean_t isdelete) {
 			if (isdelete) {
 				rdataclass = dns_rdataclass_any;
 				rdatatype = dns_rdatatype_any;
+				rdata->flags = DNS_RDATA_UPDATE;
 				goto doneparsing;
 			} else {
 				fprintf(stderr, "failed to read type\n");
@@ -930,17 +934,17 @@ update_addordelete(char *cmdline, isc_boolean_t isdelete) {
 	}
 
 	retval = parse_rdata(&cmdline, rdataclass, rdatatype, updatemsg,
-			     &rdata);
+			     rdata);
 	if (retval != STATUS_MORE)
 		goto failure;
 
 	if (isdelete) {
-		if (rdata->length == 0)
+		if ((rdata->flags & DNS_RDATA_UPDATE) != 0)
 			rdataclass = dns_rdataclass_any;
 		else
 			rdataclass = dns_rdataclass_none;
 	} else {
-		if (rdata->length == 0) {
+		if ((rdata->flags & DNS_RDATA_UPDATE) != 0) {
 			fprintf(stderr, "failed to read rdata\n");
 			goto failure;
 		}
diff --git a/lib/dns/a6.c b/lib/dns/a6.c
index b1907d97bf..041aed835d 100644
--- a/lib/dns/a6.c
+++ b/lib/dns/a6.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: a6.c,v 1.16 2000/08/01 01:22:06 tale Exp $ */
+/* $Id: a6.c,v 1.17 2000/10/25 04:26:27 marka Exp $ */
 
 #include <config.h>
 
@@ -42,7 +42,7 @@ static isc_result_t
 foreach(dns_a6context_t *a6ctx, dns_rdataset_t *parent, unsigned int depth,
 	unsigned int oprefixlen)
 {
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	isc_region_t r;
 	dns_name_t name;
 	dns_rdataset_t child;
@@ -152,6 +152,7 @@ foreach(dns_a6context_t *a6ctx, dns_rdataset_t *parent, unsigned int depth,
 				(a6ctx->address)(a6ctx);
 		}
 	next_a6:
+		dns_rdata_invalidate(&rdata);
 		result = dns_rdataset_next(parent);
 		if (result == ISC_R_SUCCESS) {
 			a6ctx->chains++;
diff --git a/lib/dns/adb.c b/lib/dns/adb.c
index 5913198aa2..b6eb317762 100644
--- a/lib/dns/adb.c
+++ b/lib/dns/adb.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: adb.c,v 1.155 2000/10/20 02:21:42 marka Exp $ */
+/* $Id: adb.c,v 1.156 2000/10/25 04:26:29 marka Exp $ */
 
 /*
  * Implementation notes
@@ -480,7 +480,7 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
 	isc_result_t result;
 	dns_adb_t *adb;
 	dns_adbnamehook_t *nh;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	struct in_addr ina;
 	struct in6_addr in6a;
 	isc_sockaddr_t sockaddr;
@@ -507,6 +507,7 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
 	nh = NULL;
 	result = dns_rdataset_first(rdataset);
 	while (result == ISC_R_SUCCESS) {
+		dns_rdata_invalidate(&rdata);
 		dns_rdataset_current(rdataset, &rdata);
 		if (rdtype == dns_rdatatype_a) {
 			INSIST(rdata.length == 4);
@@ -976,7 +977,7 @@ set_target(dns_adb_t *adb, dns_name_t *name, dns_name_t *fname,
 	dns_namereln_t namereln;
 	unsigned int nlabels, nbits;
 	int order;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_fixedname_t fixed1, fixed2;
 	dns_name_t *prefix, *new_target;
 
diff --git a/lib/dns/byaddr.c b/lib/dns/byaddr.c
index 2c277f8ef3..0c6ea9fea5 100644
--- a/lib/dns/byaddr.c
+++ b/lib/dns/byaddr.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: byaddr.c,v 1.23 2000/10/17 01:57:41 bwelling Exp $ */
+/* $Id: byaddr.c,v 1.24 2000/10/25 04:26:30 marka Exp $ */
 
 #include <config.h>
 
@@ -128,7 +128,7 @@ static inline isc_result_t
 copy_ptr_targets(dns_byaddr_t *byaddr, dns_rdataset_t *rdataset) {
 	isc_result_t result;
 	dns_name_t *name;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 
 	/*
 	 * The caller must be holding the byaddr's lock.
@@ -154,6 +154,7 @@ copy_ptr_targets(dns_byaddr_t *byaddr, dns_rdataset_t *rdataset) {
 			return (ISC_R_NOMEMORY);
 		}
 		ISC_LIST_APPEND(byaddr->event->names, name, link);
+		dns_rdata_invalidate(&rdata);
 		result = dns_rdataset_next(rdataset);
 	}
 	if (result == ISC_R_NOMORE)
diff --git a/lib/dns/db.c b/lib/dns/db.c
index c22243601b..eeef470649 100644
--- a/lib/dns/db.c
+++ b/lib/dns/db.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: db.c,v 1.58 2000/10/18 23:53:21 marka Exp $ */
+/* $Id: db.c,v 1.59 2000/10/25 04:26:31 marka Exp $ */
 
 /***
  *** Imports
@@ -643,7 +643,7 @@ dns_db_getsoaserial(dns_db_t *db, dns_dbversion_t *ver, isc_uint32_t *serialp)
 	isc_result_t result;
 	dns_dbnode_t *node = NULL;
 	dns_rdataset_t rdataset;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	isc_buffer_t buffer;
 
 	REQUIRE(dns_db_iszone(db) || dns_db_isstub(db));
@@ -662,6 +662,8 @@ dns_db_getsoaserial(dns_db_t *db, dns_dbversion_t *ver, isc_uint32_t *serialp)
  	if (result != ISC_R_SUCCESS)
 		goto freerdataset;
 	dns_rdataset_current(&rdataset, &rdata);
+	result = dns_rdataset_next(&rdataset);
+	INSIST(result = ISC_R_NOMORE);
 
 	INSIST(rdata.length > 20);
 	isc_buffer_init(&buffer, rdata.data, rdata.length);
diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
index 2e9108de39..edbf776c25 100644
--- a/lib/dns/dnssec.c
+++ b/lib/dns/dnssec.c
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: dnssec.c,v 1.53 2000/10/07 00:09:20 bwelling Exp $
+ * $Id: dnssec.c,v 1.54 2000/10/25 04:26:32 marka Exp $
  */
 
 
@@ -108,6 +108,7 @@ rdataset_to_sortedarray(dns_rdataset_t *set, isc_mem_t *mctx,
 	 * Put them in the array.
 	 */
 	do {
+		dns_rdata_init(&data[i]);
 		dns_rdataset_current(set, &data[i++]);
 	} while (dns_rdataset_next(set) == ISC_R_SUCCESS);
 
@@ -451,7 +452,7 @@ dns_dnssec_findzonekeys(dns_db_t *db, dns_dbversion_t *ver,
 			unsigned int *nkeys)
 {
 	dns_rdataset_t rdataset;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	isc_result_t result;
 	dst_key_t *pubkey = NULL;
 	unsigned int count = 0;
@@ -485,6 +486,7 @@ dns_dnssec_findzonekeys(dns_db_t *db, dns_dbversion_t *ver,
 		count++;
  next:
 		dst_key_free(&pubkey);
+		dns_rdata_invalidate(&rdata);
 		result = dns_rdataset_next(&rdataset);
 	}
 	if (result != ISC_R_NOMORE)
@@ -642,7 +644,7 @@ dns_dnssec_verifymessage(isc_buffer_t *source, dns_message_t *msg,
 {
 	dns_rdata_sig_t sig;
 	unsigned char header[DNS_MESSAGE_HEADERLEN];
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	isc_region_t r, source_r, sig_r, header_r;
 	isc_stdtime_t now;
 	dst_context_t *ctx = NULL;
diff --git a/lib/dns/include/dns/rdata.h b/lib/dns/include/dns/rdata.h
index 7ccf967e7f..e1c17bda3b 100644
--- a/lib/dns/include/dns/rdata.h
+++ b/lib/dns/include/dns/rdata.h
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdata.h,v 1.44 2000/10/24 02:03:33 marka Exp $ */
+/* $Id: rdata.h,v 1.45 2000/10/25 04:26:56 marka Exp $ */
 
 #ifndef DNS_RDATA_H
 #define DNS_RDATA_H 1
@@ -125,6 +125,8 @@ struct dns_rdata {
 	ISC_LINK(dns_rdata_t)		link;
 };
 
+#define DNS_RDATA_INIT { NULL, 0, 0, 0, 0, {(void*)(-1), (void *)(-1)}}
+
 #define DNS_RDATA_UPDATE	0x0001		/* update pseudo record */
 
 /*
@@ -163,7 +165,7 @@ dns_rdata_invalidate(dns_rdata_t *rdata);
  */
 
 void
-dns_rdata_clone(dns_rdata_t *src, dns_rdata_t *target);
+dns_rdata_clone(const dns_rdata_t *src, dns_rdata_t *target);
 /*
  * Clone 'target' from 'src'.
  *
diff --git a/lib/dns/journal.c b/lib/dns/journal.c
index 46ba3743fe..fe8d9f098e 100644
--- a/lib/dns/journal.c
+++ b/lib/dns/journal.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: journal.c,v 1.60 2000/10/20 13:29:32 marka Exp $ */
+/* $Id: journal.c,v 1.61 2000/10/25 04:26:33 marka Exp $ */
 
 #include <config.h>
 
@@ -127,7 +127,7 @@ dns_db_createsoatuple(dns_db_t *db, dns_dbversion_t *ver, isc_mem_t *mctx,
 	isc_result_t result;
 	dns_dbnode_t *node;
 	dns_rdataset_t rdataset;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_name_t *zonename;
 
 	zonename = dns_db_origin(db);
@@ -202,10 +202,9 @@ dns_difftuple_create(isc_mem_t *mctx,
 	t->ttl = ttl;
 
 	memcpy(datap, rdata->data, rdata->length);
+	dns_rdata_init(&t->rdata);
+	dns_rdata_clone(rdata, &t->rdata);
 	t->rdata.data = datap;
-	t->rdata.length = rdata->length;
-	t->rdata.rdclass = rdata->rdclass;
-	t->rdata.type = rdata->type;
 	datap += rdata->length;
 
 	ISC_LINK_INIT(&t->rdata, link);
@@ -592,7 +591,7 @@ dns_diff_print(dns_diff_t *diff, FILE *file) {
 
 		dns_rdatalist_t rdl;
 		dns_rdataset_t rds;
-		dns_rdata_t rd;
+		dns_rdata_t rd = DNS_RDATA_INIT;
 
 		result = diff_tuple_tordataset(t, &rd, &rdl, &rds);
 		if (result != ISC_R_SUCCESS) {
@@ -2143,6 +2142,7 @@ read_one_rr(dns_journal_t *j) {
 	 * Parse the rdata.
 	 */
 	isc_buffer_setactive(&j->it.source, rdlen);
+	dns_rdata_invalidate(&j->it.rdata);
 	CHECK(dns_rdata_fromwire(&j->it.rdata, rdclass,
 				 rdtype, &j->it.source, &j->it.dctx,
 				 ISC_FALSE, &j->it.target));
@@ -2222,7 +2222,7 @@ get_name_diff(dns_db_t *db, dns_dbversion_t *ver, isc_stdtime_t now,
 		     result == ISC_R_SUCCESS;
 		     result = dns_rdataset_next(&rdataset))
 		{
-			dns_rdata_t rdata;
+			dns_rdata_t rdata = DNS_RDATA_INIT;
 			dns_rdataset_current(&rdataset, &rdata);
 			result = dns_difftuple_create(diff->mctx, op, name,
 						      rdataset.ttl, &rdata,
diff --git a/lib/dns/lookup.c b/lib/dns/lookup.c
index 575ab0e93c..736804e605 100644
--- a/lib/dns/lookup.c
+++ b/lib/dns/lookup.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lookup.c,v 1.1 2000/10/17 01:57:42 bwelling Exp $ */
+/* $Id: lookup.c,v 1.2 2000/10/25 04:26:34 marka Exp $ */
 
 #include <config.h>
 
@@ -147,7 +147,7 @@ lookup_find(dns_lookup_t *lookup, dns_fetchevent_t *event) {
 	isc_boolean_t send_event = ISC_FALSE;
 	dns_name_t *name, *fname, *prefix;
 	dns_fixedname_t foundname, fixed;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	unsigned int nlabels, nbits;
 	int order;
 	dns_namereln_t namereln;
@@ -220,6 +220,7 @@ lookup_find(dns_lookup_t *lookup, dns_fetchevent_t *event) {
 				break;
 			dns_rdataset_current(&lookup->rdataset, &rdata);
 			result = dns_rdata_tostruct(&rdata, &cname, NULL);
+			dns_rdata_invalidate(&rdata);
 			if (result != ISC_R_SUCCESS)
 				break;
 			result = dns_name_concatenate(&cname.cname, NULL, name,
@@ -240,6 +241,7 @@ lookup_find(dns_lookup_t *lookup, dns_fetchevent_t *event) {
 				break;
 			dns_rdataset_current(&lookup->rdataset, &rdata);
 			result = dns_rdata_tostruct(&rdata, &dname, NULL);
+			dns_rdata_invalidate(&rdata);
 			if (result != ISC_R_SUCCESS)
 				break;
 			/*
diff --git a/lib/dns/master.c b/lib/dns/master.c
index 2782c255ad..e5ae20d24e 100644
--- a/lib/dns/master.c
+++ b/lib/dns/master.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: master.c,v 1.74 2000/10/20 02:21:46 marka Exp $ */
+/* $Id: master.c,v 1.75 2000/10/25 04:26:36 marka Exp $ */
 
 #include <config.h>
 
@@ -525,7 +525,7 @@ generate(dns_loadctx_t *ctx, char *range, char *lhs, char *gtype, char *rhs) {
 	char *rhsbuf = NULL;
 	dns_fixedname_t ownerfixed;
 	dns_name_t *owner;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_rdatacallbacks_t *callbacks;
 	dns_rdatalist_t rdatalist;
 	dns_rdatatype_t type;
@@ -646,8 +646,10 @@ generate(dns_loadctx_t *ctx, char *range, char *lhs, char *gtype, char *rhs) {
 		ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
 		result = commit(callbacks, ctx->lex, &head, owner,
 				ctx->top);
+		ISC_LIST_UNLINK(rdatalist.rdata, &rdata, link);
 		if (result != ISC_R_SUCCESS)
 			goto error_cleanup;
+		dns_rdata_invalidate(&rdata);
 	}
 	result = ISC_R_SUCCESS;
 	goto cleanup;
diff --git a/lib/dns/masterdump.c b/lib/dns/masterdump.c
index a136a863c5..1bbeea8178 100644
--- a/lib/dns/masterdump.c
+++ b/lib/dns/masterdump.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: masterdump.c,v 1.34 2000/09/08 21:47:03 gson Exp $ */
+/* $Id: masterdump.c,v 1.35 2000/10/25 04:26:37 marka Exp $ */
 
 #include <config.h>
 
@@ -417,7 +417,7 @@ rdataset_totext(dns_rdataset_t *rdataset,
 		 * Rdata.
 		 */
 		{
-			dns_rdata_t rdata;
+			dns_rdata_t rdata = DNS_RDATA_INIT;
 			isc_region_t r;
 
 			INDENT_TO(rdata_column);
diff --git a/lib/dns/message.c b/lib/dns/message.c
index dccfdcfc8f..1f9e72e95e 100644
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: message.c,v 1.154 2000/10/20 20:40:46 mws Exp $ */
+/* $Id: message.c,v 1.155 2000/10/25 04:26:38 marka Exp $ */
 
 /***
  *** Imports
@@ -844,24 +844,6 @@ getrdata(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 	unsigned int tries;
 	unsigned int trysize;
 
-	/*
-	 * In dynamic update messages, the rdata can be empty.
-	 */
-	if (msg->opcode == dns_opcode_update && rdatalen == 0) {
-		/*
-		 * When the rdata is empty, the data pointer is never
-		 * dereferenced, but it must still be non-NULL.  Casting
-		 * 1 rather than "" avoids warnings about discarding
-		 * the const attribute of a string, for compilers that
-		 * would warn about such things.
-		 */
-		rdata->data = (unsigned char *)1;
-		rdata->length = 0;
-		rdata->rdclass = rdclass;
-		rdata->type = rdtype;
-		return (ISC_R_SUCCESS);
-	}
-
 	scratch = currentbuffer(msg);
 
 	isc_buffer_setactive(source, rdatalen);
@@ -1070,6 +1052,16 @@ getquestions(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 	return (result);
 }
 
+static isc_boolean_t
+update(dns_section_t section, dns_rdataclass_t rdclass) {
+	if (section == DNS_SECTION_PREREQUISITE)
+		return (ISC_TF(rdclass == dns_rdataclass_any ||
+			rdclass == dns_rdataclass_none));
+		if (section == DNS_SECTION_UPDATE)
+			return (ISC_TF(rdclass == dns_rdataclass_any));
+	return (ISC_FALSE);
+}
+
 static isc_result_t
 getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 	   dns_section_t sectionid, unsigned int options)
@@ -1231,7 +1223,26 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 			result = ISC_R_NOMEMORY;
 			goto cleanup;
 		}
-		if (rdtype == dns_rdatatype_tsig)
+		if (msg->opcode == dns_opcode_update &&
+		    update(sectionid, rdclass)) {
+			if (rdatalen != 0) {
+				result = DNS_R_FORMERR;
+				goto cleanup;
+			}
+			/*
+			 * When the rdata is empty, the data pointer is
+			 * never dereferenced, but it must still be non-NULL. 
+			 * Casting 1 rather than "" avoids warnings about
+			 * discarding the const attribute of a string,
+			 * for compilers that would warn about such things.
+			 */
+			rdata->data = (unsigned char *)1;
+			rdata->length = 0;
+			rdata->rdclass = rdclass;
+			rdata->type = rdtype;
+			rdata->flags = DNS_RDATA_UPDATE;
+			result = ISC_R_SUCCESS;
+		} else if (rdtype == dns_rdatatype_tsig)
 			result = getrdata(source, msg, dctx, rdclass,
 					  rdtype, rdatalen, rdata);
 		else
@@ -1240,7 +1251,7 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 		if (result != ISC_R_SUCCESS)
 			goto cleanup;
 		rdata->rdclass = rdclass;
-		if (rdtype == dns_rdatatype_sig && rdata->length > 0) {
+		if (rdtype == dns_rdatatype_sig && rdata->flags == 0) {
 			covers = dns_rdata_covers(rdata);
 			if (covers == 0 &&
 				 sectionid == DNS_SECTION_ADDITIONAL)
@@ -2277,7 +2288,7 @@ dns_message_getopt(dns_message_t *msg) {
 isc_result_t
 dns_message_setopt(dns_message_t *msg, dns_rdataset_t *opt) {
 	isc_result_t result;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 
 	/*
 	 * Set the OPT record for 'msg'.
@@ -2434,7 +2445,7 @@ isc_result_t
 dns_message_getquerytsig(dns_message_t *msg, isc_mem_t *mctx,
 			 isc_buffer_t **querytsig) {
 	isc_result_t result;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	isc_region_t r;
 
 	REQUIRE(DNS_MESSAGE_VALID(msg));
@@ -2557,7 +2568,7 @@ dns_message_takebuffer(dns_message_t *msg, isc_buffer_t **buffer) {
 isc_result_t
 dns_message_signer(dns_message_t *msg, dns_name_t *signer) {
 	isc_result_t result = ISC_R_SUCCESS;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 
 	REQUIRE(DNS_MESSAGE_VALID(msg));
 	REQUIRE(signer != NULL);
@@ -2639,7 +2650,7 @@ dns_message_checksig(dns_message_t *msg, dns_view_t *view) {
 	if (msg->tsigkey != NULL || msg->tsig != NULL)
 		return (dns_view_checksig(view, &msgb, msg));
 	else {
-		dns_rdata_t rdata;
+		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_rdata_sig_t sig;
 		dns_rdataset_t keyset;
 		isc_result_t result;
diff --git a/lib/dns/ncache.c b/lib/dns/ncache.c
index f1d4358174..f28cec302f 100644
--- a/lib/dns/ncache.c
+++ b/lib/dns/ncache.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ncache.c,v 1.21 2000/08/01 01:22:35 tale Exp $ */
+/* $Id: ncache.c,v 1.22 2000/10/25 04:26:39 marka Exp $ */
 
 #include <config.h>
 
@@ -46,7 +46,7 @@ copy_rdataset(dns_rdataset_t *rdataset, isc_buffer_t *buffer) {
 	isc_result_t result;
 	unsigned int count;
 	isc_region_t ar, r;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 
 	/*
 	 * Copy the rdataset count to the buffer.
@@ -76,6 +76,7 @@ copy_rdataset(dns_rdataset_t *rdataset, isc_buffer_t *buffer) {
 		result = isc_buffer_copyregion(buffer, &r);
 		if (result != ISC_R_SUCCESS)
 			return (result);
+		dns_rdata_invalidate(&rdata);
 		result = dns_rdataset_next(rdataset);
 	}
 	if (result != ISC_R_NOMORE)
@@ -97,7 +98,7 @@ dns_ncache_add(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 	dns_name_t *name;
 	dns_ttl_t ttl;
 	dns_trust_t trust;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_rdataset_t ncrdataset;
 	dns_rdatalist_t ncrdatalist;
 	unsigned char data[4096];
@@ -226,12 +227,12 @@ dns_ncache_add(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 	 * Now add it to the cache.
 	 */
 	INSIST(trust != 0xffff);
-	dns_rdata_init(&rdata);
 	isc_buffer_usedregion(&buffer, &r);
 	rdata.data = r.base;
 	rdata.length = r.length;
 	rdata.rdclass = dns_db_class(cache);
 	rdata.type = 0;
+	rdata.flags = 0;
 
 	ncrdatalist.rdclass = rdata.rdclass;
 	ncrdatalist.type = 0;
@@ -254,7 +255,7 @@ isc_result_t
 dns_ncache_towire(dns_rdataset_t *rdataset, dns_compress_t *cctx,
 		  isc_buffer_t *target, unsigned int *countp)
 {
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	isc_result_t result;
 	isc_region_t remaining, tremaining;
 	isc_buffer_t source, savedbuffer, rdlen;
@@ -301,7 +302,7 @@ dns_ncache_towire(dns_rdataset_t *rdataset, dns_compress_t *cctx,
 			 */
 			isc_buffer_remainingregion(&source, &remaining);
 			INSIST(remaining.length >= 2);
-			dns_rdata_init(&rdata);
+			dns_rdata_invalidate(&rdata);
 			rdata.length = isc_buffer_getuint16(&source);
 			isc_buffer_remainingregion(&source, &remaining);
 			rdata.data = remaining.base;
diff --git a/lib/dns/nxt.c b/lib/dns/nxt.c
index 82969fce53..d0d26516cf 100644
--- a/lib/dns/nxt.c
+++ b/lib/dns/nxt.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nxt.c,v 1.23 2000/10/20 02:21:48 marka Exp $ */
+/* $Id: nxt.c,v 1.24 2000/10/25 04:26:40 marka Exp $ */
 
 #include <config.h>
 
@@ -138,7 +138,7 @@ dns_nxt_build(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node,
 	      dns_name_t *target, dns_ttl_t ttl)
 {
 	isc_result_t result;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	unsigned char data[DNS_NXT_BUFFERSIZE];
 	dns_rdatalist_t rdatalist;
 	dns_rdataset_t rdataset;
diff --git a/lib/dns/opt.c b/lib/dns/opt.c
index 26f781950b..8bc881c73e 100644
--- a/lib/dns/opt.c
+++ b/lib/dns/opt.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: opt.c,v 1.3 2000/10/19 23:40:31 gson Exp $ */
+/* $Id: opt.c,v 1.4 2000/10/25 04:26:42 marka Exp $ */
 
 #include <config.h>
 
@@ -46,7 +46,7 @@ optget(dns_optlist_t *optlist, dns_rdataset_t *optset,
        isc_uint16_t code, isc_boolean_t getall)
 {
 	isc_result_t result;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	unsigned int location;
 	isc_region_t rdataregion;
 	isc_buffer_t rdatabuf;
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index a12655e394..8e7875d260 100644
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rbtdb.c,v 1.129 2000/10/20 02:21:49 marka Exp $ */
+/* $Id: rbtdb.c,v 1.130 2000/10/25 04:26:43 marka Exp $ */
 
 /*
  * Principal Author: Bob Halley
@@ -3718,7 +3718,7 @@ endload(dns_db_t *db, dns_dbload_t **dbloadp) {
 					     NULL, dns_rdatatype_key, 0,
 					     0, &keyset, NULL);
 		if (result == ISC_R_SUCCESS) {
-			dns_rdata_t keyrdata;
+			dns_rdata_t keyrdata = DNS_RDATA_INIT;
 			result = dns_rdataset_first(&keyset);
 			while (result == ISC_R_SUCCESS) {
 				dns_rdataset_current(&keyset, &keyrdata);
diff --git a/lib/dns/rdata.c b/lib/dns/rdata.c
index 23062000e4..e32891e5c7 100644
--- a/lib/dns/rdata.c
+++ b/lib/dns/rdata.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdata.c,v 1.112 2000/10/24 02:03:32 marka Exp $ */
+/* $Id: rdata.c,v 1.113 2000/10/25 04:26:44 marka Exp $ */
 
 #include <config.h>
 #include <ctype.h>
@@ -330,10 +330,18 @@ dns_rdata_init(dns_rdata_t *rdata) {
 	/* ISC_LIST_INIT(rdata->list); */
 }
 
+#define DNS_RDATA_INITALISED(rdata) \
+	((rdata)->data == NULL && (rdata)->length == 0 && \
+	 (rdata)->rdclass == 0 && (rdata)->type == 0 && (rdata)->flags == 0 && \
+	 !ISC_LINK_LINKED((rdata), link))
+#define DNS_RDATA_VALIDFLAGS(rdata) \
+	(((rdata)->flags & ~DNS_RDATA_UPDATE) == 0)
+
 void
 dns_rdata_invalidate(dns_rdata_t *rdata) {
 
 	REQUIRE(!ISC_LINK_LINKED(rdata, link));
+	REQUIRE(DNS_RDATA_VALIDFLAGS(rdata));
 
 	rdata->data = NULL;
 	rdata->length = 0;
@@ -342,8 +350,18 @@ dns_rdata_invalidate(dns_rdata_t *rdata) {
 	rdata->flags = 0;
 }
 
+/***
+ ***
+ ***/
+
 void
-dns_rdata_clone(dns_rdata_t *src, dns_rdata_t *target) {
+dns_rdata_clone(const dns_rdata_t *src, dns_rdata_t *target) {
+
+	REQUIRE(DNS_RDATA_INITALISED(target));
+
+	REQUIRE(DNS_RDATA_VALIDFLAGS(src));
+	REQUIRE(DNS_RDATA_VALIDFLAGS(target));
+
 	target->data = src->data;
 	target->length = src->length;
 	target->rdclass = src->rdclass;
@@ -365,6 +383,8 @@ dns_rdata_compare(const dns_rdata_t *rdata1, const dns_rdata_t *rdata2) {
 	REQUIRE(rdata2 != NULL);
 	REQUIRE(rdata1->data != NULL);
 	REQUIRE(rdata2->data != NULL);
+	REQUIRE(DNS_RDATA_VALIDFLAGS(rdata1));
+	REQUIRE(DNS_RDATA_VALIDFLAGS(rdata2));
 
 	if (rdata1->rdclass != rdata2->rdclass)
 		return (rdata1->rdclass < rdata2->rdclass ? -1 : 1);
@@ -395,12 +415,16 @@ dns_rdata_fromregion(dns_rdata_t *rdata, dns_rdataclass_t rdclass,
 {
 
 	REQUIRE(rdata != NULL);
+	REQUIRE(DNS_RDATA_INITALISED(rdata));
 	REQUIRE(r != NULL);
 
+	REQUIRE(DNS_RDATA_VALIDFLAGS(rdata));
+
 	rdata->data = r->base;
 	rdata->length = r->length;
 	rdata->rdclass = rdclass;
 	rdata->type = type;
+	rdata->flags = 0;
 }
 
 void
@@ -408,6 +432,7 @@ dns_rdata_toregion(const dns_rdata_t *rdata, isc_region_t *r) {
 
 	REQUIRE(rdata != NULL);
 	REQUIRE(r != NULL);
+	REQUIRE(DNS_RDATA_VALIDFLAGS(rdata));
 
 	r->base = rdata->data;
 	r->length = rdata->length;
@@ -427,6 +452,10 @@ dns_rdata_fromwire(dns_rdata_t *rdata, dns_rdataclass_t rdclass,
 	isc_uint32_t activelength;
 
 	REQUIRE(dctx != NULL);
+	if (rdata != NULL) {
+		REQUIRE(DNS_RDATA_INITALISED(rdata));
+		REQUIRE(DNS_RDATA_VALIDFLAGS(rdata));
+	}
 
 	ss = *source;
 	st = *target;
@@ -477,12 +506,18 @@ dns_rdata_towire(dns_rdata_t *rdata, dns_compress_t *cctx,
 	isc_buffer_t st;
 
 	REQUIRE(rdata != NULL);
+	REQUIRE(DNS_RDATA_VALIDFLAGS(rdata));
 
 	/*
 	 * Some DynDNS meta-RRs have empty rdata.
 	 */
-	if (rdata->length == 0)
+	if ((rdata->flags & DNS_RDATA_UPDATE) != 0) {
+		INSIST(rdata->length == 0);
 		return (ISC_R_SUCCESS);
+	}
+#if 0
+	INSIST(rdata->type == dns_rdatatype_opt || rdata->length != 0);	/* XXXMPA remove */
+#endif
 
 	st = *target;
 
@@ -521,6 +556,11 @@ dns_rdata_fromtextgeneric(dns_rdata_t *rdata, dns_rdataclass_t rdclass,
 	void (*callback)(dns_rdatacallbacks_t *, const char *, ...);
 	isc_result_t iresult;
 
+	if (rdata != NULL) {
+		REQUIRE(DNS_RDATA_INITALISED(rdata));
+		REQUIRE(DNS_RDATA_VALIDFLAGS(rdata));
+	}
+
 	st = *target;
 	region.base = (unsigned char *)(target->base) + target->used;
 
@@ -618,6 +658,10 @@ dns_rdata_fromtext(dns_rdata_t *rdata, dns_rdataclass_t rdclass,
 	isc_result_t iresult;
 
 	REQUIRE(origin == NULL || dns_name_isabsolute(origin) == ISC_TRUE);
+	if (rdata != NULL) {
+		REQUIRE(DNS_RDATA_INITALISED(rdata));
+		REQUIRE(DNS_RDATA_VALIDFLAGS(rdata));
+	}
 
 	st = *target;
 	region.base = (unsigned char *)(target->base) + target->used;
@@ -748,10 +792,13 @@ rdata_totext(dns_rdata_t *rdata, dns_rdata_textctx_t *tctx,
 isc_result_t
 dns_rdata_totext(dns_rdata_t *rdata, dns_name_t *origin, isc_buffer_t *target)
 {
+	dns_rdata_textctx_t tctx;
+
+	REQUIRE(DNS_RDATA_VALIDFLAGS(rdata));
+
 	/*
 	 * Set up formatting options for single-line output.
 	 */
-	dns_rdata_textctx_t tctx;
 	tctx.origin = origin;
 	tctx.flags = 0;
 	tctx.width = 60;
@@ -764,10 +811,13 @@ dns_rdata_tofmttext(dns_rdata_t *rdata, dns_name_t *origin,
 		    unsigned int flags, unsigned int width,
 		    char *linebreak, isc_buffer_t *target)
 {
+	dns_rdata_textctx_t tctx;
+
+	REQUIRE(DNS_RDATA_VALIDFLAGS(rdata));
+
 	/*
 	 * Set up formatting options for formatted output.
 	 */
-	dns_rdata_textctx_t tctx;
 	tctx.origin = origin;
 	tctx.flags = flags;
 	if ((flags & DNS_STYLEFLAG_MULTILINE) != 0) {
@@ -791,6 +841,10 @@ dns_rdata_fromstruct(dns_rdata_t *rdata, dns_rdataclass_t rdclass,
 	isc_boolean_t use_default = ISC_FALSE;
 
 	REQUIRE(source != NULL);
+	if (rdata != NULL) {
+		REQUIRE(DNS_RDATA_INITALISED(rdata));
+		REQUIRE(DNS_RDATA_VALIDFLAGS(rdata));
+	}
 
 	region.base = (unsigned char *)(target->base) + target->used;
 	st = *target;
@@ -815,6 +869,7 @@ dns_rdata_tostruct(dns_rdata_t *rdata, void *target, isc_mem_t *mctx) {
 	isc_boolean_t use_default = ISC_FALSE;
 
 	REQUIRE(rdata != NULL);
+	REQUIRE(DNS_RDATA_VALIDFLAGS(rdata));
 
 	TOSTRUCTSWITCH
 
@@ -846,6 +901,7 @@ dns_rdata_additionaldata(dns_rdata_t *rdata, dns_additionaldatafunc_t add,
 
 	REQUIRE(rdata != NULL);
 	REQUIRE(add != NULL);
+	REQUIRE(DNS_RDATA_VALIDFLAGS(rdata));
 
 	ADDITIONALDATASWITCH
 
@@ -868,6 +924,7 @@ dns_rdata_digest(dns_rdata_t *rdata, dns_digestfunc_t digest, void *arg) {
 
 	REQUIRE(rdata != NULL);
 	REQUIRE(digest != NULL);
+	REQUIRE(DNS_RDATA_VALIDFLAGS(rdata));
 
 	DIGESTSWITCH
 
diff --git a/lib/dns/rdatalist.c b/lib/dns/rdatalist.c
index abfd8866cc..8432f2dea1 100644
--- a/lib/dns/rdatalist.c
+++ b/lib/dns/rdatalist.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdatalist.c,v 1.23 2000/08/21 22:17:14 bwelling Exp $ */
+/* $Id: rdatalist.c,v 1.24 2000/10/25 04:26:45 marka Exp $ */
 
 #include <config.h>
 
@@ -121,8 +121,7 @@ isc__rdatalist_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata) {
 	list_rdata = rdataset->private2;
 	INSIST(list_rdata != NULL);
 
-	*rdata = *list_rdata;
-	ISC_LINK_INIT(rdata, link);
+	dns_rdata_clone(list_rdata, rdata);
 }
 
 void
diff --git a/lib/dns/rdataset.c b/lib/dns/rdataset.c
index bab214c42b..66c8bc25d9 100644
--- a/lib/dns/rdataset.c
+++ b/lib/dns/rdataset.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdataset.c,v 1.50 2000/10/11 17:44:13 mws Exp $ */
+/* $Id: rdataset.c,v 1.51 2000/10/25 04:26:47 marka Exp $ */
 
 #include <config.h>
 
@@ -321,6 +321,7 @@ dns_rdataset_towire(dns_rdataset_t *rdataset,
 			i = 0;
 			do {
 				INSIST(i < count);
+				dns_rdata_init(&shuffled[i]);
 				dns_rdataset_current(rdataset, &shuffled[i]);
 				i++;
 				result = dns_rdataset_next(rdataset);
@@ -391,8 +392,10 @@ dns_rdataset_towire(dns_rdataset_t *rdataset,
 			 */
 			if (shuffle)
 				rdata = shuffled[i];
-			else
+			else {
+				dns_rdata_init(&rdata);
 				dns_rdataset_current(rdataset, &rdata);
+			}
 			result = dns_rdata_towire(&rdata, cctx, target);
 			if (result != ISC_R_SUCCESS)
 				goto rollback;
@@ -455,6 +458,7 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
 		return (result);
 
 	do {
+		dns_rdata_init(&rdata);
 		dns_rdataset_current(rdataset, &rdata);
 		result = dns_rdata_additionaldata(&rdata, add, arg);
 		if (result == ISC_R_SUCCESS)
diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c
index 903412a891..a901987d36 100644
--- a/lib/dns/rdataslab.c
+++ b/lib/dns/rdataslab.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdataslab.c,v 1.21 2000/10/18 23:53:24 marka Exp $ */
+/* $Id: rdataslab.c,v 1.22 2000/10/25 04:26:48 marka Exp $ */
 
 #include <config.h>
 
@@ -67,6 +67,7 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 	INSIST(result == ISC_R_SUCCESS);
 	for (i = 0; i < nalloc; i++) {
 		INSIST(result == ISC_R_SUCCESS);
+		dns_rdata_init(&rdatas[i]);
 		dns_rdataset_current(rdataset, &rdatas[i]);
 		result = dns_rdataset_next(rdataset);
 	}
@@ -189,18 +190,17 @@ rdata_in_slab(unsigned char *slab, unsigned int reservelen,
 {
 	unsigned int count, i;
 	unsigned char *current;
-	dns_rdata_t trdata;
+	dns_rdata_t trdata = DNS_RDATA_INIT;
 
 	current = slab + reservelen;
 	count = *current++ * 256;
 	count += *current++;
 
-	dns_rdata_init(&trdata);
-
 	for (i = 0; i < count; i++) {
 		rdata_from_slab(&current, rdclass, type, &trdata);
 		if (dns_rdata_compare(&trdata, rdata) == 0)
 			return (ISC_TRUE);
+		dns_rdata_invalidate(&trdata);
 	}
 	return (ISC_FALSE);
 }
@@ -214,7 +214,8 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 	unsigned char *ocurrent, *ostart, *ncurrent, *tstart, *tcurrent;
 	unsigned int ocount, ncount, count, olength, tlength, tcount, length;
 	isc_region_t nregion;
-	dns_rdata_t ordata, nrdata;
+	dns_rdata_t ordata = DNS_RDATA_INIT;
+	dns_rdata_t nrdata = DNS_RDATA_INIT;
 	isc_boolean_t added_something = ISC_FALSE;
 	unsigned int oadded = 0;
 	unsigned int nadded = 0;
@@ -266,6 +267,7 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 		nregion.length = *ncurrent++ * 256;
 		nregion.length += *ncurrent++;
 		nregion.base = ncurrent;
+		dns_rdata_init(&nrdata);
 		dns_rdata_fromregion(&nrdata, rdclass, type, &nregion);
 		if (!rdata_in_slab(oslab, reservelen, rdclass, type, &nrdata))
 		{
@@ -310,6 +312,7 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 	ncurrent = nslab + reservelen + 2;
 	if (ncount > 0) {
 		do {
+			dns_rdata_invalidate(&nrdata);
        			rdata_from_slab(&ncurrent, rdclass, type, &nrdata);
 		} while (rdata_in_slab(oslab, reservelen, rdclass,
 				       type, &nrdata));
@@ -331,6 +334,7 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 			tcurrent += length;
 			oadded++;
 			if (oadded < ocount) {
+				dns_rdata_invalidate(&ordata);
        				rdata_from_slab(&ocurrent, rdclass, type,
 						&ordata);
 			}
@@ -343,6 +347,7 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 			nadded++;
 			if (nadded < ncount) {
 				do {
+					dns_rdata_invalidate(&nrdata);
        					rdata_from_slab(&ncurrent, rdclass,
 							type, &nrdata);
 				} while (rdata_in_slab(oslab, reservelen,
@@ -367,7 +372,8 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab,
 {
 	unsigned char *mcurrent, *sstart, *scurrent, *tstart, *tcurrent;
 	unsigned int mcount, scount, rcount ,count, tlength, tcount;
-	dns_rdata_t srdata, mrdata;
+	dns_rdata_t srdata = DNS_RDATA_INIT;
+	dns_rdata_t mrdata = DNS_RDATA_INIT;
 
 	REQUIRE(tslabp != NULL && *tslabp == NULL);
 	REQUIRE(mslab != NULL && sslab != NULL);
@@ -401,6 +407,7 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab,
 		rdata_from_slab(&mcurrent, rdclass, type, &mrdata);
 		scurrent = sstart;
 		for (count = 0; count < scount; count++) {
+			dns_rdata_invalidate(&srdata);
 			rdata_from_slab(&scurrent, rdclass, type, &srdata);
 			if (dns_rdata_compare(&mrdata, &srdata) == 0)
 				break;
@@ -415,6 +422,7 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab,
 		} else
 			rcount++;
 		mcount--;
+		dns_rdata_invalidate(&mrdata);
 	} while (mcount > 0);
 
 	/*
@@ -462,6 +470,7 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab,
 		rdata_from_slab(&mcurrent, rdclass, type, &mrdata);
 		scurrent = sstart;
 		for (count = 0; count < scount; count++) {
+			dns_rdata_invalidate(&srdata);
 			rdata_from_slab(&scurrent, rdclass, type, &srdata);
 			if (dns_rdata_compare(&mrdata, &srdata) == 0)
 				break;
@@ -475,6 +484,7 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab,
 			memcpy(tcurrent, mrdatabegin, length);
 			tcurrent += length;
 		}
+		dns_rdata_invalidate(&mrdata);
 		mcount--;
 	} while (mcount > 0);
 
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 6f5e7f7f1a..3b81cfd078 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: resolver.c,v 1.173 2000/10/20 02:21:51 marka Exp $ */
+/* $Id: resolver.c,v 1.174 2000/10/25 04:26:49 marka Exp $ */
 
 #include <config.h>
 
@@ -617,6 +617,7 @@ fctx_addopt(dns_message_t *message) {
 	rdata->length = 0;
 	rdata->rdclass = rdatalist->rdclass;
 	rdata->type = rdatalist->type;
+	rdata->flags = 0;
 
 	ISC_LIST_INIT(rdatalist->rdata);
 	ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
@@ -1299,7 +1300,7 @@ sort_finds(fetchctx_t *fctx) {
 
 static isc_result_t
 fctx_getaddresses(fetchctx_t *fctx) {
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	isc_result_t result;
 	dns_resolver_t *res;
 	isc_stdtime_t now;
@@ -1463,6 +1464,7 @@ fctx_getaddresses(fetchctx_t *fctx) {
 				dns_adb_destroyfind(&find);
 			}
 		}
+		dns_rdata_invalidate(&rdata);
 		dns_rdata_freestruct(&ns);
 		result = dns_rdataset_next(&fctx->nameservers);
 	}
@@ -3093,7 +3095,7 @@ check_related(void *arg, dns_name_t *addname, dns_rdatatype_t type) {
 static inline isc_result_t
 cname_target(dns_rdataset_t *rdataset, dns_name_t *tname) {
 	isc_result_t result;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_rdata_cname_t cname;
 
 	result = dns_rdataset_first(rdataset);
@@ -3115,7 +3117,7 @@ dname_target(dns_rdataset_t *rdataset, dns_name_t *qname, dns_name_t *oname,
 	     dns_fixedname_t *fixeddname)
 {
 	isc_result_t result;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	unsigned int nlabels, nbits;
 	int order;
 	dns_namereln_t namereln;
@@ -3930,7 +3932,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	tsigset = dns_message_gettsig(message, &tsigowner);
 	if (tsigset != NULL) {
 		dns_rdata_any_tsig_t tsig;
-		dns_rdata_t rdata;
+		dns_rdata_t rdata = DNS_RDATA_INIT;
 
 		result = dns_rdataset_first(tsigset);
 		if (result != ISC_R_SUCCESS)
diff --git a/lib/dns/sec/dst/dst_api.c b/lib/dns/sec/dst/dst_api.c
index 46418d5d1e..fee784e43a 100644
--- a/lib/dns/sec/dst/dst_api.c
+++ b/lib/dns/sec/dst/dst_api.c
@@ -19,7 +19,7 @@
 
 /*
  * Principal Author: Brian Wellington
- * $Id: dst_api.c,v 1.63 2000/09/16 01:12:19 bwelling Exp $
+ * $Id: dst_api.c,v 1.64 2000/10/25 04:26:57 marka Exp $
  */
 
 #include <config.h>
@@ -845,7 +845,7 @@ read_public_key(const char *filename, isc_mem_t *mctx, dst_key_t **keyp) {
 	isc_lex_t *lex = NULL;
 	isc_token_t token;
 	isc_result_t ret;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	unsigned int opt = ISC_LEXOPT_DNSMULTILINE;
 	char *newfilename;
 	isc_textregion_t r;
@@ -959,7 +959,7 @@ write_public_key(const dst_key_t *key, const char *directory) {
 	char text_array[DST_KEY_MAXSIZE];
 	char class_array[10];
 	isc_result_t ret;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 
 	REQUIRE(VALID_KEY(key));
 
diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
index 28195fd7a1..dbc9f32c91 100644
--- a/lib/dns/tsig.c
+++ b/lib/dns/tsig.c
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: tsig.c,v 1.93 2000/10/12 00:40:51 bwelling Exp $
+ * $Id: tsig.c,v 1.94 2000/10/25 04:26:50 marka Exp $
  * Principal Author: Brian Wellington
  */
 
@@ -415,7 +415,7 @@ dns_tsig_sign(dns_message_t *msg) {
 		 * If this is a response, digest the query signature.
 		 */
 		if (is_response(msg)) {
-			dns_rdata_t querytsigrdata;
+			dns_rdata_t querytsigrdata = DNS_RDATA_INIT;
 
 			ret = dns_rdataset_first(msg->querytsig);
 			if (ret != ISC_R_SUCCESS)
@@ -612,7 +612,7 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 	isc_buffer_t databuf;
 	unsigned char data[32];
 	dns_name_t *keyname;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	isc_stdtime_t now;
 	isc_result_t ret;
 	dns_tsigkey_t *tsigkey;
@@ -661,6 +661,7 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 	ret = dns_rdata_tostruct(&rdata, &tsig, NULL);
 	if (ret != ISC_R_SUCCESS)
 		return (ret);
+	dns_rdata_invalidate(&rdata);
 	if (is_response(msg)) {
 		ret = dns_rdataset_first(msg->querytsig);
 		if (ret != ISC_R_SUCCESS)
@@ -865,7 +866,7 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
 	isc_buffer_t databuf;
 	unsigned char data[32];
 	dns_name_t *keyname;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	isc_stdtime_t now;
 	isc_result_t ret;
 	dns_tsigkey_t *tsigkey;
@@ -896,6 +897,7 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
 	ret = dns_rdata_tostruct(&rdata, &querytsig, NULL);
 	if (ret != ISC_R_SUCCESS)
 		return (ret);
+	dns_rdata_invalidate(&rdata);
 
 	/*
 	 * If there is a TSIG in this message, do some checks.
diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 3f0709cdff..2099f04b8b 100644
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: validator.c,v 1.82 2000/10/07 00:09:28 bwelling Exp $ */
+/* $Id: validator.c,v 1.83 2000/10/25 04:26:52 marka Exp $ */
 
 #include <config.h>
 
@@ -360,7 +360,7 @@ nxtprovesnonexistence(dns_validator_t *val, dns_name_t *nxtname,
 		      dns_rdataset_t *nxtset, dns_rdataset_t *signxtset)
 {
 	int order;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	isc_result_t result;
 
 	result = dns_rdataset_first(nxtset);
@@ -393,6 +393,7 @@ nxtprovesnonexistence(dns_validator_t *val, dns_name_t *nxtname,
 		 * The NXT owner name is less than the nonexistent name.
 		 */
 		result = dns_rdata_tostruct(&rdata, &nxt, NULL);
+		dns_rdata_invalidate(&rdata);
 		INSIST(result == ISC_R_SUCCESS);
 		order = dns_name_compare(val->event->name, &nxt.next);
 		if (order >= 0) {
@@ -592,7 +593,7 @@ containsnullkey(dns_validator_t *val, dns_rdataset_t *rdataset) {
 	isc_result_t result;
 	dst_key_t *key = NULL;
 	isc_buffer_t b;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	isc_boolean_t found = ISC_FALSE;
 
 	result = dns_rdataset_first(rdataset);
@@ -614,6 +615,7 @@ containsnullkey(dns_validator_t *val, dns_rdataset_t *rdataset) {
 		if (dst_key_isnullkey(key))
 			found = ISC_TRUE;
 		dst_key_free(&key);
+		dns_rdata_invalidate(&rdata);
 		result = dns_rdataset_next(rdataset);
 	}
 	return (found);
@@ -632,7 +634,7 @@ get_dst_key(dns_validator_t *val, dns_rdata_sig_t *siginfo,
 {
 	isc_result_t result;
 	isc_buffer_t b;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dst_key_t *oldkey = val->key;
 	isc_boolean_t foundold;
 
@@ -674,6 +676,7 @@ get_dst_key(dns_validator_t *val, dns_rdata_sig_t *siginfo,
 			}
 		}
 		dst_key_free(&val->key);
+		dns_rdata_invalidate(&rdata);
 		result = dns_rdataset_next(rdataset);
 	} while (result == ISC_R_SUCCESS);
 	if (result == ISC_R_NOMORE)
@@ -857,7 +860,7 @@ issecurityroot(dns_validator_t *val) {
 	dns_rdataset_t *rdataset;
 	isc_mem_t *mctx;
 	dns_keytable_t *secroots;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	isc_result_t result;
 	dns_keynode_t *keynode, *nextnode;
 	dst_key_t *key, *secrootkey;
@@ -875,6 +878,7 @@ issecurityroot(dns_validator_t *val) {
 		dns_rdataset_current(rdataset, &rdata);
 		key = NULL;
 		result = dns_dnssec_keyfromrdata(name, &rdata, mctx, &key);
+		dns_rdata_invalidate(&rdata);
 		if (result != ISC_R_SUCCESS)
 			 continue;
 		keynode = NULL;
@@ -918,7 +922,7 @@ static inline isc_result_t
 validate(dns_validator_t *val, isc_boolean_t resume) {
 	isc_result_t result;
 	dns_validatorevent_t *event;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 
 	/*
 	 * Caller must be holding the validator lock.
@@ -962,6 +966,7 @@ validate(dns_validator_t *val, isc_boolean_t resume) {
 	     result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(event->sigrdataset))
 	{
+		dns_rdata_invalidate(&rdata);
 		dns_rdataset_current(event->sigrdataset, &rdata);
 		if (val->siginfo != NULL)
 			isc_mem_put(val->view->mctx, val->siginfo,
@@ -1136,14 +1141,13 @@ nxtvalidate(dns_validator_t *val, isc_boolean_t resume) {
 			if (val->event->type == dns_rdatatype_key &&
 			    dns_name_equal(name, val->event->name))
 			{
-				dns_rdata_t nxt;
+				dns_rdata_t nxt = DNS_RDATA_INIT;
 
 				if (rdataset->type != dns_rdatatype_nxt)
 					continue;
 
 				result = dns_rdataset_first(rdataset);
 				INSIST(result == ISC_R_SUCCESS);
-				dns_rdata_init(&nxt);
 				dns_rdataset_current(rdataset, &nxt);
 				if (dns_nxt_typepresent(&nxt,
 							dns_rdatatype_soa))
diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c
index 3fb75cbd09..9d8300d702 100644
--- a/lib/dns/xfrin.c
+++ b/lib/dns/xfrin.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: xfrin.c,v 1.102 2000/10/16 04:26:08 marka Exp $ */
+/* $Id: xfrin.c,v 1.103 2000/10/25 04:26:53 marka Exp $ */
 
 #include <config.h>
 
@@ -849,7 +849,7 @@ tuple2msgname(dns_difftuple_t *tuple, dns_message_t *msg, dns_name_t **target)
 
 	CHECK(dns_message_gettemprdata(msg, &rdata));
 	dns_rdata_init(rdata);
-	*rdata = tuple->rdata; /* Struct assignment. */
+	dns_rdata_clone(&tuple->rdata, rdata);
 
 	CHECK(dns_message_gettemprdatalist(msg, &rdl));
 	dns_rdatalist_init(rdl);
@@ -1109,7 +1109,7 @@ xfrin_recv_done(isc_task_t *task, isc_event_t *ev) {
 			     result == ISC_R_SUCCESS;
 			     result = dns_rdataset_next(rds))
 			{
-				dns_rdata_t rdata;
+				dns_rdata_t rdata = DNS_RDATA_INIT;
 				dns_rdataset_current(rds, &rdata);
 				CHECK(xfr_rr(xfr, name, rds->ttl, &rdata));
 			}
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index bd502b871f..e28bb3a287 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: zone.c,v 1.239 2000/10/23 00:31:28 marka Exp $ */
+/* $Id: zone.c,v 1.240 2000/10/25 04:26:54 marka Exp $ */
 
 #include <config.h>
 
@@ -1221,7 +1221,7 @@ zone_load_soa_rr(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	isc_result_t result;
 	unsigned int count;
 	dns_rdataset_t rdataset;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_rdata_soa_t soa;
 
 	dns_rdataset_init(&rdataset);
@@ -1233,12 +1233,14 @@ zone_load_soa_rr(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	count = 0;
 	result = dns_rdataset_first(&rdataset);
 	while (result == ISC_R_SUCCESS) {
+		dns_rdata_init(&rdata);
 		dns_rdataset_current(&rdataset, &rdata);
 		count++;
 		if (count == 1)
 			dns_rdata_tostruct(&rdata, &soa, NULL);
 
 		result = dns_rdataset_next(&rdataset);
+		dns_rdata_invalidate(&rdata);
 	}
 	dns_rdataset_disassociate(&rdataset);
 
@@ -2376,7 +2378,7 @@ dns_zone_notify(dns_zone_t *zone) {
 	dns_name_t master;
 	dns_rdata_ns_t ns;
 	dns_rdata_soa_t soa;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_rdataset_t nsrdset;
 	dns_rdataset_t soardset;
 	isc_result_t result;
@@ -2464,6 +2466,7 @@ dns_zone_notify(dns_zone_t *zone) {
 	while (result == ISC_R_SUCCESS) {
 		dns_rdataset_current(&soardset, &rdata);
 		result = dns_rdata_tostruct(&rdata, &soa, NULL);
+		dns_rdata_invalidate(&rdata);
 		if (result != ISC_R_SUCCESS)
 			continue;
 		result = dns_name_dup(&soa.origin, zone->mctx, &master);
@@ -2488,6 +2491,7 @@ dns_zone_notify(dns_zone_t *zone) {
 	while (result == ISC_R_SUCCESS) {
 		dns_rdataset_current(&nsrdset, &rdata);
 		result = dns_rdata_tostruct(&rdata, &ns, NULL);
+		dns_rdata_invalidate(&rdata);
 		if (result != ISC_R_SUCCESS)
 			continue;
 		/*
@@ -2546,7 +2550,7 @@ save_nsrrset(dns_message_t *message, dns_name_t *name,
 	dns_dbnode_t *node = NULL;
 	dns_rdata_ns_t ns;
 	isc_result_t result;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 
 	/*
 	 * Extract NS RRset from message.
@@ -2576,6 +2580,7 @@ save_nsrrset(dns_message_t *message, dns_name_t *name,
 	     result = dns_rdataset_next(nsrdataset)) {
 		dns_rdataset_current(nsrdataset, &rdata);
 		result = dns_rdata_tostruct(&rdata, &ns, NULL);
+		dns_rdata_invalidate(&rdata);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		if (!dns_name_issubdomain(&ns.name, name)) {
 			result = dns_rdataset_next(nsrdataset);
@@ -2841,7 +2846,7 @@ refresh_callback(isc_task_t *task, isc_event_t *event) {
 	isc_stdtime_t now;
 	char master[ISC_SOCKADDR_FORMATSIZE];
 	dns_rdataset_t *rdataset;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_rdata_soa_t soa;
 	isc_result_t result;
 	isc_uint32_t serial;
@@ -3528,7 +3533,7 @@ notify_createmessage(dns_zone_t *zone, unsigned int flags,
 	dns_dbversion_t *version = NULL;
 	dns_message_t *message = NULL;
 	dns_rdataset_t rdataset;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 
 	dns_name_t *tempname = NULL;
 	dns_rdata_t *temprdata = NULL;
@@ -3606,7 +3611,6 @@ notify_createmessage(dns_zone_t *zone, unsigned int flags,
 	result = dns_rdataset_first(&rdataset);
 	if (result != ISC_R_SUCCESS)
 		goto soa_cleanup;
-	dns_rdata_init(&rdata);
 	dns_rdataset_current(&rdataset, &rdata);
 	dns_rdata_toregion(&rdata, &r);
 	result = isc_buffer_allocate(zone->mctx, &b, r.length);
@@ -3676,7 +3680,7 @@ dns_zone_notifyreceive(dns_zone_t *zone, isc_sockaddr_t *from,
 	unsigned int i;
 	dns_rdata_soa_t soa;
 	dns_rdataset_t *rdataset = NULL;
-	dns_rdata_t rdata;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	isc_result_t result;
 	isc_stdtime_t now;
 	char fromtext[ISC_SOCKADDR_FORMATSIZE];