qpzone.c:step() could ignore rollbacks

the step() function (used for stepping to the prececessor or
successor of a database node) could overlook a node because
there was an rdataset marked IGNORE because it had been rolled
back, covering an active rdataset under it.

diff --git a/lib/dns/qpzone.c b/lib/dns/qpzone.c
index 58039bd52f974cdfe4b349221935c95003072ac9..d4570d689ac6beae0d0181114998053734802bcd 100644 (file)
--- a/lib/dns/qpzone.c
+++ b/lib/dns/qpzone.c
@@ -2696,13 +2696,25 @@ step(qpz_search_t *search, dns_qpiter_t *it, direction_t direction,
        while (result == ISC_R_SUCCESS) {
                isc_rwlock_t *nlock = &qpdb->buckets[node->locknum].lock;
                isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+               dns_slabheader_t *header_next = NULL;
 
                NODE_RDLOCK(nlock, &nlocktype);
-               for (header = node->data; header != NULL; header = header->next)
+               for (header = node->data; header != NULL; header = header_next)
                {
-                       if (header->serial <= search->serial &&
-                           !IGNORE(header) && !NONEXISTENT(header))
-                       {
+                       header_next = header->next;
+                       while (header != NULL) {
+                               if (header->serial <= search->serial &&
+                                   !IGNORE(header))
+                               {
+                                       if (NONEXISTENT(header)) {
+                                               header = NULL;
+                                       }
+                                       break;
+                               } else {
+                                       header = header->down;
+                               }
+                       }
+                       if (header != NULL) {
                                break;
                        }
                }