From 77e0a89ad55fe7fbd82aac26d0447df528b84ca2 Mon Sep 17 00:00:00 2001
From: Miod Vallat <miod.vallat@powerdns.com>
Date: Tue, 1 Jul 2025 21:29:56 +0200
Subject: [PATCH] Pass an explicit RecordsRWTransaction to
 writeNSEC3RecordPair.

Otherwise it would use d_rwtxn, which could be nullptr sometimes if
invoked invoked from updateDNSSECOrderNameAndAuth.

Regression introduced in 91df390a5583bfacb5fb7e646c03916da8afc477, reported
by Coverity.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
---
 modules/lmdbbackend/lmdbbackend.cc | 12 ++++++------
 modules/lmdbbackend/lmdbbackend.hh |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/modules/lmdbbackend/lmdbbackend.cc b/modules/lmdbbackend/lmdbbackend.cc
index 17390a5ab4..a895b7a8ab 100644
--- a/modules/lmdbbackend/lmdbbackend.cc
+++ b/modules/lmdbbackend/lmdbbackend.cc
@@ -1188,7 +1188,7 @@ bool LMDBBackend::abortTransaction()
   return true;
 }
 
-void LMDBBackend::writeNSEC3RecordPair(domainid_t domain_id, const DNSName& qname, const DNSName& ordername)
+void LMDBBackend::writeNSEC3RecordPair(const std::shared_ptr<RecordsRWTransaction>& txn, domainid_t domain_id, const DNSName& qname, const DNSName& ordername)
 {
   compoundOrdername co; // NOLINT(readability-identifier-length)
   LMDBResourceRecord lrr;
@@ -1198,13 +1198,13 @@ void LMDBBackend::writeNSEC3RecordPair(domainid_t domain_id, const DNSName& qnam
   lrr.ttl = 0;
   lrr.content = qname.toDNSStringLC();
   string ser = serializeToBuffer(lrr);
-  d_rwtxn->txn->put(d_rwtxn->db->dbi, co(domain_id, ordername, QType::NSEC3), ser);
+  txn->txn->put(d_rwtxn->db->dbi, co(domain_id, ordername, QType::NSEC3), ser);
 
   // Write qname -> ordername forward chain record with ttl set to 1
   lrr.ttl = 1;
   lrr.content = ordername.toDNSString();
   ser = serializeToBuffer(lrr);
-  d_rwtxn->txn->put(d_rwtxn->db->dbi, co(domain_id, qname, QType::NSEC3), ser);
+  txn->txn->put(d_rwtxn->db->dbi, co(domain_id, qname, QType::NSEC3), ser);
 }
 
 // d_rwtxn must be set here
@@ -1231,7 +1231,7 @@ bool LMDBBackend::feedRecord(const DNSResourceRecord& r, const DNSName& ordernam
     MDBOutVal val;
     // Only add the NSEC3 chain records if there aren't any.
     if (d_rwtxn->txn->get(d_rwtxn->db->dbi, co(lrr.domain_id, lrr.qname, QType::NSEC3), val)) {
-      writeNSEC3RecordPair(lrr.domain_id, lrr.qname, ordername);
+      writeNSEC3RecordPair(d_rwtxn, lrr.domain_id, lrr.qname, ordername);
     }
   }
   return true;
@@ -1269,7 +1269,7 @@ bool LMDBBackend::feedEnts3(domainid_t domain_id, const DNSName& domain, map<DNS
 
     if (!narrow && lrr.auth) {
       ordername = DNSName(toBase32Hex(hashQNameWithSalt(ns3prc, nt.first)));
-      writeNSEC3RecordPair(domain_id, lrr.qname, ordername);
+      writeNSEC3RecordPair(d_rwtxn, domain_id, lrr.qname, ordername);
     }
   }
   return true;
@@ -2714,7 +2714,7 @@ bool LMDBBackend::updateDNSSECOrderNameAndAuth(domainid_t domain_id, const DNSNa
   }
 
   if (hasOrderName && del) {
-    writeNSEC3RecordPair(domain_id, rel, ordername);
+    writeNSEC3RecordPair(txn, domain_id, rel, ordername);
   }
 
   if (needCommit)
diff --git a/modules/lmdbbackend/lmdbbackend.hh b/modules/lmdbbackend/lmdbbackend.hh
index f3280c8663..612aa6a016 100644
--- a/modules/lmdbbackend/lmdbbackend.hh
+++ b/modules/lmdbbackend/lmdbbackend.hh
@@ -342,7 +342,7 @@ private:
   static bool getAfterForwardFromStart(MDBROCursor& cursor, MDBOutVal& key, MDBOutVal& val, domainid_t id, DNSName& after);
   static bool isNSEC3BackRecord(LMDBResourceRecord& lrr, const MDBOutVal& key, const MDBOutVal& val);
   static bool isValidAuthRecord(const MDBOutVal& key, const MDBOutVal& val);
-  void writeNSEC3RecordPair(domainid_t domain_id, const DNSName& qname, const DNSName& ordername);
+  void writeNSEC3RecordPair(const std::shared_ptr<RecordsRWTransaction>& txn, domainid_t domain_id, const DNSName& qname, const DNSName& ordername);
 
   bool get_list(DNSZoneRecord& rr);
   bool get_lookup(DNSZoneRecord& rr);
-- 
2.47.2