From: Ondřej Surý <ondrej@isc.org>
Date: Sat, 14 Mar 2026 07:20:43 +0000 (+0100)
Subject: Guard against NULL delegset in query_delegation_recurse()
X-Git-Tag: v9.21.21~4^2~9
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a1cb966944afe9f3bf371d801d1125d27eca2f47;p=thirdparty%2Fbind9.git

Guard against NULL delegset in query_delegation_recurse()

If both dns_view_bestzonecut() and dns_deleg_fromrdataset() fail,
delegset stays NULL.  Passing it to ns_query_recurse() would crash
on the REQUIRE(DNS_DELEGSET_VALID(delegset)) in createfetch().

Return ISC_R_NOTFOUND instead, which lets the caller handle the
failure gracefully.
---

diff --git a/lib/ns/query.c b/lib/ns/query.c
index b25b37c91f6..f9f43b363c3 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -8670,8 +8670,13 @@ query_delegation_recurse(query_ctx_t *qctx) {
 			fname = qctx->fname;
 		}
 
-		result = ns_query_recurse(qctx->client, qctx->qtype, qname,
-					  fname, delegset, qctx->resuming);
+		if (delegset == NULL) {
+			result = ISC_R_NOTFOUND;
+		} else {
+			result = ns_query_recurse(qctx->client, qctx->qtype,
+						  qname, fname, delegset,
+						  qctx->resuming);
+		}
 
 		if (delegset != NULL) {
 			dns_delegset_detach(&delegset);