From: W.C.A. Wijngaards <wouter@nlnetlabs.nl>
Date: Wed, 1 Oct 2025 13:52:15 +0000 (+0200)
Subject: - xfr-tsig, flip buffer after tsig_sign_reply, but not for error_encode.
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c622a71a280d85f9c6d654ded6c6208a8e97cd9a;p=thirdparty%2Funbound.git

- xfr-tsig, flip buffer after tsig_sign_reply, but not for error_encode.
---

diff --git a/daemon/worker.c b/daemon/worker.c
index 00bb233e6..5088a63c7 100644
--- a/daemon/worker.c
+++ b/daemon/worker.c
@@ -1228,8 +1228,10 @@ answer_notify(struct worker* w, struct query_info* qinfo,
 				*(uint16_t*)(void *)sldns_buffer_begin(pkt),
 				sldns_buffer_read_u16_at(pkt, 2), edns);
 			LDNS_OPCODE_SET(sldns_buffer_begin(pkt), LDNS_PACKET_NOTIFY);
+		} else {
+			/* Flip to delimit buffer after tsig_sign_reply. */
+			sldns_buffer_flip(pkt);
 		}
-		sldns_buffer_flip(pkt);
 		/* The tsig veriable is allocated in the scratch region. */
 	}
 }