registrars: Fix an edge-case with lookup("r")

This fixes a bug where the registrar library would return
E_LOOKUP_NO_RESULTS upon encountering an AoR with 0 contacts, instead of
continuing to walk the branches and expand the remaining AoRs.

Many thanks to @MayamaTakeshi for a detailed bug report!
Fixes #2917

lib/reg/lookup.c

@@ -125,7 +125,11 @@ lookup_rc lookup(struct sip_msg *req, udomain_t *d, const str *sflags, str *aor_
 	if (rc > 0) {
 		LM_DBG("'%.*s' Not found in usrloc\n", aor.len, ZSW(aor.s));
 		ul.unlock_udomain(d, &aor);
-		return LOOKUP_NO_RESULTS;
+
+		if ((flags & REG_BRANCH_AOR_LOOKUP_FLAG) && idx < nbranches)
+			goto next_aor;
+
+		goto done;
 	}
 
 	print_urecord(r);
@@ -176,6 +180,7 @@ lookup_rc lookup(struct sip_msg *req, udomain_t *d, const str *sflags, str *aor_
 		ul.release_urecord(r, 0);
 		ul.unlock_udomain(d, &aor);
 
+	next_aor:
 		aor_uri = &branch_uris[idx];
 		LM_DBG("getting contacts from aor [%.*s] "
 		       "in branch %d\n", aor_uri->len, aor_uri->s, idx);
@@ -196,8 +201,10 @@ lookup_rc lookup(struct sip_msg *req, udomain_t *d, const str *sflags, str *aor_
 	else if (have_pn_cts)
 		ret = LOOKUP_PN_SENT;
 
-	ul.release_urecord(r, 0);
-	ul.unlock_udomain(d, &aor);
+	if (r) {
+		ul.release_urecord(r, 0);
+		ul.unlock_udomain(d, &aor);
+	}
 out_cleanup:
 	if (flags & REG_LOOKUP_UAFILTER_FLAG)
 		regfree(&ua_re);