From: Vladimír Čunát <vladimir.cunat@nic.cz>
Date: Wed, 11 Sep 2019 15:57:41 +0000 (+0200)
Subject: lib/resolve creation of first query: fix a rare possible bug
X-Git-Tag: v5.2.0~9^2~4
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a9406f78284cc7e04adf659721f74378da45c8af;p=thirdparty%2Fknot-resolver.git

lib/resolve creation of first query: fix a rare possible bug

qname here wasn't lower-cased, so the match might not be correct.
Still, practically all deployments use either root TA or none,
and these can't be affected.
---

diff --git a/lib/resolve.c b/lib/resolve.c
index 44fbef588..0cef2f97c 100644
--- a/lib/resolve.c
+++ b/lib/resolve.c
@@ -776,7 +776,7 @@ static int resolve_query(struct kr_request *request, const knot_pkt_t *packet)
 		qry->flags.AWAIT_CUT = true;
 		/* Want DNSSEC if it's posible to secure this name (e.g. is covered by any TA) */
 		if ((knot_wire_get_ad(packet->wire) || knot_pkt_has_dnssec(packet)) &&
-		    kr_ta_covers_qry(request->ctx, qname, qtype)) {
+		    kr_ta_covers_qry(request->ctx, qry->sname, qtype)) {
 			qry->flags.DNSSEC_WANT = true;
 		}
 	}