From 8b2ff6c3889e0c23dceef4b10a1b1de58e463cb9 Mon Sep 17 00:00:00 2001
From: Chris O'Haver <cohaver@infoblox.com>
Date: Thu, 21 Jan 2021 03:59:58 -0500
Subject: [PATCH] make copies of RRs before returning them (#4409)

Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
---
 plugin/file/lookup.go | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/plugin/file/lookup.go b/plugin/file/lookup.go
index 6eeb4c397f3..cba1eec50e3 100644
--- a/plugin/file/lookup.go
+++ b/plugin/file/lookup.go
@@ -171,7 +171,12 @@ func (z *Zone) Lookup(ctx context.Context, state request.Request, qname string)
 			return z.externalLookup(ctx, state, elem, rrs)
 		}
 
-		rrs := elem.Type(qtype)
+		treeRRs := elem.Type(qtype)
+		// make a copy of the element RRs to prevent response writers from mutating the tree
+		rrs := make([]dns.RR, len(treeRRs))
+		for i, rr := range treeRRs {
+			rrs[i] = dns.Copy(rr)
+		}
 
 		// NODATA
 		if len(rrs) == 0 {