Merge branch 'master' into valid-nxdomain

Conflicts: lib/dnssec/nsec3.c

diff --cc lib/dnssec/nsec3.c
index 3707b3ae7ee370e47af5cf1bd780eec0d31f9c4c,1ebf3850ebe68baec0e170e4d23b8b2a8d3645d1..fd683cb6171ee898e246fb4c100ce61d4bbd5ddc
--- 1/lib/dnssec/nsec3.c
--- 2/lib/dnssec/nsec3.c
+++ b/lib/dnssec/nsec3.c
@@@ -692,8 -746,10 +689,9 @@@ int kr_nsec3_ref_to_unsigned(const knot
                if (ns->type != KNOT_RRTYPE_NS) {
                        continue;
                }
+ 
+               int flags = 0;
                bool nsec3_found = false;
-               flags = 0;
 -
                for (unsigned j = 0; j < sec->count; ++j) {
                        const knot_rrset_t *nsec3 = knot_pkt_rr(sec, j);
                        if (nsec3->type == KNOT_RRTYPE_DS) {
@@@ -703,11 -759,22 +701,14 @@@
                                continue;
                        }
                        nsec3_found = true;
 -                      /* nsec3 found, check if owner name matches
 -                       * the delegation name
 -                       */
 -                      int ret = matches_name(&flags, nsec3, ns->owner);
 -                      if (ret != 0) {
 -                              return kr_error(EINVAL);
 -                      }
 -                      if (!(flags & FLG_NAME_MATCHED)) {
 -                              /* nsec3 owner name does not match
 -                               * the delegation name
 -                               */
 +                      /* nsec3 found, check if owner name matches the delegation name.
 +                       * Just skip in case of *any* errors. */
 +                      if (matches_name(nsec3, ns->owner) != kr_ok()) {
                                continue;
                        }
+ 
+                       uint8_t *bm = NULL;
+                       uint16_t bm_size = 0;
                        knot_nsec3_bitmap(&nsec3->rrs, 0, &bm, &bm_size);
                        if (!bm) {
                                return kr_error(EINVAL);