plugin/pkg/dnsutil: guard Join against an empty label slice (#8225)

plugin/pkg/dnsutil/join.go

@@ -10,6 +10,9 @@ import (
 // the root label it is ignored. Not other syntax checks are performed.
 func Join(labels ...string) string {
 	ll := len(labels)
+	if ll == 0 {
+		return "."
+	}
 	if labels[ll-1] == "." {
 		return strings.Join(labels[:ll-1], ".") + "."
 	}

plugin/pkg/dnsutil/join_test.go

@@ -19,3 +19,12 @@ func TestJoin(t *testing.T) {
 		}
 	}
 }
+
+func TestJoinEmpty(t *testing.T) {
+	// Join called with no labels must not index labels[ll-1] out of range; it
+	// returns the root name. Callers on the MX/SRV path can reach Join with an
+	// empty label slice.
+	if x := Join(); x != "." {
+		t.Errorf("expected %q, got %q", ".", x)
+	}
+}