From: Fabian Groffen <grobian@bitzolder.nl>
Date: Sat, 28 Jun 2025 08:34:01 +0000 (+0200)
Subject: ldns_resolver_search_status: ensure returning pkt with LDNS_STATUS_OK
X-Git-Tag: 1.9.0-rc.1~22
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a48ca376a0ca4051790ff5f6dde045035b30a430;p=thirdparty%2Fldns.git

ldns_resolver_search_status: ensure returning pkt with LDNS_STATUS_OK

Ensure we return a pkt by returning the final one in case the input is
not an absolute dname and no error occurred getting a response packet.

The return of ldns_resolver_query_status can be LDNS_STATUS_OK, but the
rcode from pkt an error.  In such case, when all search domains are
exhausted and the final query is done on the input dname as is, *pkt is
set freed and set to NULL, while s still is LDNS_STATUS_OK.  As a
result, the function returns with LDNS_STATUS_OK and pkt NULL.

This particular return makes the caller unable to handle the return
sensically, other than guessing there was an error of some sort.  By
returning the last retrieved pkt, the caller is able to get the RCODE
and return a meaningful error (such as SERVFAIL).

Signed-off-by: Fabian Groffen <grobian@bitzolder.nl>
---

diff --git a/resolver.c b/resolver.c
index a426b82c..1b1c43bc 100644
--- a/resolver.c
+++ b/resolver.c
@@ -1082,9 +1082,10 @@ ldns_resolver_search_status(ldns_pkt** pkt,
 						LDNS_RCODE_NOERROR) {
 
 					return LDNS_STATUS_OK;
+				} else if (i < ldns_resolver_searchlist_count(r)) {
+					ldns_pkt_free(*pkt);
+					*pkt = NULL;
 				}
-				ldns_pkt_free(*pkt);
-				*pkt = NULL;
 			}
 		}
 	}