From acb83a79fc29a16c34e842bc1a1dd55d10328191 Mon Sep 17 00:00:00 2001
From: Peter van Dijk <peter.van.dijk@powerdns.com>
Date: Wed, 3 Nov 2021 14:00:30 +0100
Subject: [PATCH] auth bindbackend: skip rejected zones during list and search,
 fixes #10885

---
 modules/bindbackend/bindbackend2.cc | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/modules/bindbackend/bindbackend2.cc b/modules/bindbackend/bindbackend2.cc
index 54d9c612ba..2922798a9e 100644
--- a/modules/bindbackend/bindbackend2.cc
+++ b/modules/bindbackend/bindbackend2.cc
@@ -1301,6 +1301,10 @@ bool Bind2Backend::list(const DNSName& target, int id, bool include_disabled)
   d_handle.reset();
   DLOG(g_log << "Bind2Backend constructing handle for list of " << id << endl);
 
+  if (!bbd.d_loaded) {
+    throw PDNSException("zone was not loaded, perhaps because of: " + bbd.d_status);
+  }
+
   d_handle.d_records = bbd.d_records.get(); // give it a copy, which will stay around
   d_handle.d_qname_iter = d_handle.d_records->begin();
   d_handle.d_qname_end = d_handle.d_records->end(); // iter now points to a vector of pointers to vector<BBResourceRecords>
@@ -1437,6 +1441,10 @@ bool Bind2Backend::searchRecords(const string& pattern, int maxResults, vector<D
         continue;
       }
 
+      if (!h.d_loaded) {
+        continue;
+      }
+
       shared_ptr<const recordstorage_t> rhandle = h.d_records.get();
 
       for (recordstorage_t::const_iterator ri = rhandle->begin(); result.size() < static_cast<vector<DNSResourceRecord>::size_type>(maxResults) && ri != rhandle->end(); ri++) {
-- 
2.47.2