3 commit d668061994a7486a3ba9c7d5e7882d85a2883707
4 Author: Andreas Schwab <schwab@suse.de>
5 Date: Thu Feb 13 11:01:57 2014 +0100
7 Fix memory leak in _nss_dns_gethostbyname4_r with big DNS answer
9 commit ab7ac0f2cf8731fe4c3f3aea6088a7c0127b5725
10 Author: Ondřej Bílka <neleai@seznam.cz>
11 Date: Sun Feb 16 12:59:23 2014 +0100
13 Deduplicate resolv/nss_dns/dns-host.c
15 In resolv/nss_dns/dns-host.c one of code path duplicated code after
16 that. We merge these paths.
18 commit ab09bf616ad527b249aca5f2a4956fd526f0712f
19 Author: Andreas Schwab <schwab@suse.de>
20 Date: Tue Feb 18 10:57:25 2014 +0100
22 Properly fix memory leak in _nss_dns_gethostbyname4_r with big DNS answer
24 Instead of trying to guess whether the second buffer needs to be freed
25 set a flag at the place it is allocated
27 Index: glibc-2.12-2-gc4ccff1/include/resolv.h
28 ===================================================================
29 --- glibc-2.12-2-gc4ccff1.orig/include/resolv.h
30 +++ glibc-2.12-2-gc4ccff1/include/resolv.h
31 @@ -58,11 +58,11 @@ libc_hidden_proto (__res_randomid)
32 libc_hidden_proto (__res_state)
34 int __libc_res_nquery (res_state, const char *, int, int, u_char *, int,
35 - u_char **, u_char **, int *, int *);
36 + u_char **, u_char **, int *, int *, int *);
37 int __libc_res_nsearch (res_state, const char *, int, int, u_char *, int,
38 - u_char **, u_char **, int *, int *);
39 + u_char **, u_char **, int *, int *, int *);
40 int __libc_res_nsend (res_state, const u_char *, int, const u_char *, int,
41 - u_char *, int, u_char **, u_char **, int *, int *)
42 + u_char *, int, u_char **, u_char **, int *, int *, int *)
45 libresolv_hidden_proto (_sethtent)
46 Index: glibc-2.12-2-gc4ccff1/resolv/gethnamaddr.c
47 ===================================================================
48 --- glibc-2.12-2-gc4ccff1.orig/resolv/gethnamaddr.c
49 +++ glibc-2.12-2-gc4ccff1/resolv/gethnamaddr.c
50 @@ -634,7 +634,7 @@ gethostbyname2(name, af)
51 buf.buf = origbuf = (querybuf *) alloca (1024);
53 if ((n = __libc_res_nsearch(&_res, name, C_IN, type, buf.buf->buf, 1024,
54 - &buf.ptr, NULL, NULL, NULL)) < 0) {
55 + &buf.ptr, NULL, NULL, NULL, NULL)) < 0) {
56 if (buf.buf != origbuf)
58 Dprintf("res_nsearch failed (%d)\n", n);
59 @@ -729,12 +729,12 @@ gethostbyaddr(addr, len, af)
60 buf.buf = orig_buf = (querybuf *) alloca (1024);
62 n = __libc_res_nquery(&_res, qbuf, C_IN, T_PTR, buf.buf->buf, 1024,
63 - &buf.ptr, NULL, NULL, NULL);
64 + &buf.ptr, NULL, NULL, NULL, NULL);
65 if (n < 0 && af == AF_INET6 && (_res.options & RES_NOIP6DOTINT) == 0) {
66 strcpy(qp, "ip6.int");
67 n = __libc_res_nquery(&_res, qbuf, C_IN, T_PTR, buf.buf->buf,
68 buf.buf != orig_buf ? MAXPACKET : 1024,
69 - &buf.ptr, NULL, NULL, NULL);
70 + &buf.ptr, NULL, NULL, NULL, NULL);
73 if (buf.buf != orig_buf)
74 Index: glibc-2.12-2-gc4ccff1/resolv/nss_dns/dns-canon.c
75 ===================================================================
76 --- glibc-2.12-2-gc4ccff1.orig/resolv/nss_dns/dns-canon.c
77 +++ glibc-2.12-2-gc4ccff1/resolv/nss_dns/dns-canon.c
78 @@ -62,7 +62,7 @@ _nss_dns_getcanonname_r (const char *nam
80 int r = __libc_res_nquery (&_res, name, ns_c_in, qtypes[i],
81 buf, sizeof (buf), &ansp.ptr, NULL, NULL,
86 /* We need to decode the response. Just one question record.
87 Index: glibc-2.12-2-gc4ccff1/resolv/nss_dns/dns-host.c
88 ===================================================================
89 --- glibc-2.12-2-gc4ccff1.orig/resolv/nss_dns/dns-host.c
90 +++ glibc-2.12-2-gc4ccff1/resolv/nss_dns/dns-host.c
91 @@ -191,7 +191,7 @@ _nss_dns_gethostbyname3_r (const char *n
92 host_buffer.buf = orig_host_buffer = (querybuf *) alloca (1024);
94 n = __libc_res_nsearch (&_res, name, C_IN, type, host_buffer.buf->buf,
95 - 1024, &host_buffer.ptr, NULL, NULL, NULL);
96 + 1024, &host_buffer.ptr, NULL, NULL, NULL, NULL);
100 @@ -221,7 +221,7 @@ _nss_dns_gethostbyname3_r (const char *n
101 n = __libc_res_nsearch (&_res, name, C_IN, T_A, host_buffer.buf->buf,
102 host_buffer.buf != orig_host_buffer
103 ? MAXPACKET : 1024, &host_buffer.ptr,
105 + NULL, NULL, NULL, NULL);
109 @@ -304,13 +304,20 @@ _nss_dns_gethostbyname4_r (const char *n
110 u_char *ans2p = NULL;
113 + int ans2p_malloced = 0;
116 enum nss_status status;
117 int n = __libc_res_nsearch (&_res, name, C_IN, T_UNSPEC,
118 host_buffer.buf->buf, 2048, &host_buffer.ptr,
119 - &ans2p, &nans2p, &resplen2);
121 + &ans2p, &nans2p, &resplen2, &ans2p_malloced);
124 + status = gaih_getanswer (host_buffer.buf, n, (const querybuf *) ans2p,
125 + resplen2, name, pat, buffer, buflen,
126 + errnop, herrnop, ttlp);
132 @@ -325,16 +332,11 @@ _nss_dns_gethostbyname4_r (const char *n
135 __set_errno (olderr);
137 - if (host_buffer.buf != orig_host_buffer)
138 - free (host_buffer.buf);
143 - status = gaih_getanswer(host_buffer.buf, n, (const querybuf *) ans2p,
144 - resplen2, name, pat, buffer, buflen,
145 - errnop, herrnop, ttlp);
146 + /* Check whether ans2p was separately allocated. */
147 + if (ans2p_malloced)
150 if (host_buffer.buf != orig_host_buffer)
151 free (host_buffer.buf);
152 @@ -444,7 +446,7 @@ _nss_dns_gethostbyaddr2_r (const void *a
153 strcpy (qp, "].ip6.arpa");
154 n = __libc_res_nquery (&_res, qbuf, C_IN, T_PTR,
155 host_buffer.buf->buf, 1024, &host_buffer.ptr,
157 + NULL, NULL, NULL, NULL);
161 @@ -465,14 +467,14 @@ _nss_dns_gethostbyaddr2_r (const void *a
164 n = __libc_res_nquery (&_res, qbuf, C_IN, T_PTR, host_buffer.buf->buf,
165 - 1024, &host_buffer.ptr, NULL, NULL, NULL);
166 + 1024, &host_buffer.ptr, NULL, NULL, NULL, NULL);
167 if (n < 0 && af == AF_INET6 && (_res.options & RES_NOIP6DOTINT) == 0)
169 strcpy (qp, "ip6.int");
170 n = __libc_res_nquery (&_res, qbuf, C_IN, T_PTR, host_buffer.buf->buf,
171 host_buffer.buf != orig_host_buffer
172 ? MAXPACKET : 1024, &host_buffer.ptr,
174 + NULL, NULL, NULL, NULL);
178 Index: glibc-2.12-2-gc4ccff1/resolv/nss_dns/dns-network.c
179 ===================================================================
180 --- glibc-2.12-2-gc4ccff1.orig/resolv/nss_dns/dns-network.c
181 +++ glibc-2.12-2-gc4ccff1/resolv/nss_dns/dns-network.c
182 @@ -130,7 +130,7 @@ _nss_dns_getnetbyname_r (const char *nam
183 net_buffer.buf = orig_net_buffer = (querybuf *) alloca (1024);
185 anslen = __libc_res_nsearch (&_res, qbuf, C_IN, T_PTR, net_buffer.buf->buf,
186 - 1024, &net_buffer.ptr, NULL, NULL, NULL);
187 + 1024, &net_buffer.ptr, NULL, NULL, NULL, NULL);
191 @@ -206,7 +206,7 @@ _nss_dns_getnetbyaddr_r (uint32_t net, i
192 net_buffer.buf = orig_net_buffer = (querybuf *) alloca (1024);
194 anslen = __libc_res_nquery (&_res, qbuf, C_IN, T_PTR, net_buffer.buf->buf,
195 - 1024, &net_buffer.ptr, NULL, NULL, NULL);
196 + 1024, &net_buffer.ptr, NULL, NULL, NULL, NULL);
200 Index: glibc-2.12-2-gc4ccff1/resolv/res_query.c
201 ===================================================================
202 --- glibc-2.12-2-gc4ccff1.orig/resolv/res_query.c
203 +++ glibc-2.12-2-gc4ccff1/resolv/res_query.c
204 @@ -98,7 +98,7 @@ static int
205 __libc_res_nquerydomain(res_state statp, const char *name, const char *domain,
206 int class, int type, u_char *answer, int anslen,
207 u_char **answerp, u_char **answerp2, int *nanswerp2,
209 + int *resplen2, int *answerp2_malloced);
212 * Formulate a normal query, send, and await answer.
213 @@ -119,7 +119,8 @@ __libc_res_nquery(res_state statp,
214 u_char **answerp, /* if buffer needs to be enlarged */
219 + int *answerp2_malloced)
221 HEADER *hp = (HEADER *) answer;
223 @@ -224,7 +225,8 @@ __libc_res_nquery(res_state statp,
225 assert (answerp == NULL || (void *) *answerp == (void *) answer);
226 n = __libc_res_nsend(statp, query1, nquery1, query2, nquery2, answer,
227 - anslen, answerp, answerp2, nanswerp2, resplen2);
228 + anslen, answerp, answerp2, nanswerp2, resplen2,
229 + answerp2_malloced);
233 @@ -316,7 +318,7 @@ res_nquery(res_state statp,
234 int anslen) /* size of answer buffer */
236 return __libc_res_nquery(statp, name, class, type, answer, anslen,
237 - NULL, NULL, NULL, NULL);
238 + NULL, NULL, NULL, NULL, NULL);
240 libresolv_hidden_def (res_nquery)
242 @@ -335,7 +337,8 @@ __libc_res_nsearch(res_state statp,
248 + int *answerp2_malloced)
250 const char *cp, * const *domain;
251 HEADER *hp = (HEADER *) answer;
252 @@ -359,7 +362,7 @@ __libc_res_nsearch(res_state statp,
253 if (!dots && (cp = res_hostalias(statp, name, tmp, sizeof tmp))!= NULL)
254 return (__libc_res_nquery(statp, cp, class, type, answer,
255 anslen, answerp, answerp2,
256 - nanswerp2, resplen2));
257 + nanswerp2, resplen2, answerp2_malloced));
260 if (statp->options & RES_DEBUG)
261 @@ -376,7 +379,8 @@ __libc_res_nsearch(res_state statp,
262 if (dots >= statp->ndots || trailing_dot) {
263 ret = __libc_res_nquerydomain(statp, name, NULL, class, type,
264 answer, anslen, answerp,
265 - answerp2, nanswerp2, resplen2);
266 + answerp2, nanswerp2, resplen2,
267 + answerp2_malloced);
268 if (ret > 0 || trailing_dot
269 /* If the second response is valid then we use that. */
270 || (ret == 0 && resplen2 != NULL && *resplen2 > 0))
271 @@ -387,12 +391,12 @@ __libc_res_nsearch(res_state statp,
276 - && (*answerp2 < answer || *answerp2 >= answer + anslen))
277 + if (answerp2 && *answerp2_malloced)
282 + *answerp2_malloced = 0;
286 @@ -418,7 +422,7 @@ __libc_res_nsearch(res_state statp,
288 answer, anslen, answerp,
291 + resplen2, answerp2_malloced);
292 if (ret > 0 || (ret == 0 && resplen2 != NULL
295 @@ -427,13 +431,12 @@ __libc_res_nsearch(res_state statp,
300 - && (*answerp2 < answer
301 - || *answerp2 >= answer + anslen))
302 + if (answerp2 && *answerp2_malloced)
307 + *answerp2_malloced = 0;
311 @@ -489,7 +492,8 @@ __libc_res_nsearch(res_state statp,
312 if (dots && !(tried_as_is || root_on_list)) {
313 ret = __libc_res_nquerydomain(statp, name, NULL, class, type,
314 answer, anslen, answerp,
315 - answerp2, nanswerp2, resplen2);
316 + answerp2, nanswerp2, resplen2,
317 + answerp2_malloced);
318 if (ret > 0 || (ret == 0 && resplen2 != NULL
321 @@ -502,11 +506,12 @@ __libc_res_nsearch(res_state statp,
322 * else send back meaningless H_ERRNO, that being the one from
323 * the last DNSRCH we did.
325 - if (answerp2 && (*answerp2 < answer || *answerp2 >= answer + anslen))
326 + if (answerp2 && *answerp2_malloced)
332 + *answerp2_malloced = 0;
334 if (saved_herrno != -1)
335 RES_SET_H_ERRNO(statp, saved_herrno);
336 @@ -526,7 +531,7 @@ res_nsearch(res_state statp,
337 int anslen) /* size of answer */
339 return __libc_res_nsearch(statp, name, class, type, answer,
340 - anslen, NULL, NULL, NULL, NULL);
341 + anslen, NULL, NULL, NULL, NULL, NULL);
343 libresolv_hidden_def (res_nsearch)
345 @@ -544,7 +549,8 @@ __libc_res_nquerydomain(res_state statp,
351 + int *answerp2_malloced)
354 const char *longname = nbuf;
355 @@ -582,7 +588,7 @@ __libc_res_nquerydomain(res_state statp,
357 return (__libc_res_nquery(statp, longname, class, type, answer,
358 anslen, answerp, answerp2, nanswerp2,
360 + resplen2, answerp2_malloced));
364 @@ -594,7 +600,8 @@ res_nquerydomain(res_state statp,
365 int anslen) /* size of answer */
367 return __libc_res_nquerydomain(statp, name, domain, class, type,
368 - answer, anslen, NULL, NULL, NULL, NULL);
369 + answer, anslen, NULL, NULL, NULL, NULL,
372 libresolv_hidden_def (res_nquerydomain)
374 Index: glibc-2.12-2-gc4ccff1/resolv/res_send.c
375 ===================================================================
376 --- glibc-2.12-2-gc4ccff1.orig/resolv/res_send.c
377 +++ glibc-2.12-2-gc4ccff1/resolv/res_send.c
378 @@ -203,12 +203,12 @@ evNowTime(struct timespec *res) {
379 static int send_vc(res_state, const u_char *, int,
381 u_char **, int *, int *, int, u_char **,
382 - u_char **, int *, int *);
383 + u_char **, int *, int *, int *);
384 static int send_dg(res_state, const u_char *, int,
386 u_char **, int *, int *, int,
387 int *, int *, u_char **,
388 - u_char **, int *, int *);
389 + u_char **, int *, int *, int *);
391 static void Aerror(const res_state, FILE *, const char *, int,
392 const struct sockaddr *);
393 @@ -360,7 +360,7 @@ int
394 __libc_res_nsend(res_state statp, const u_char *buf, int buflen,
395 const u_char *buf2, int buflen2,
396 u_char *ans, int anssiz, u_char **ansp, u_char **ansp2,
397 - int *nansp2, int *resplen2)
398 + int *nansp2, int *resplen2, int *ansp2_malloced)
400 int gotsomewhere, terrno, try, v_circuit, resplen, ns, n;
402 @@ -565,7 +565,8 @@ __libc_res_nsend(res_state statp, const
404 n = send_vc(statp, buf, buflen, buf2, buflen2,
405 &ans, &anssiz, &terrno,
406 - ns, ansp, ansp2, nansp2, resplen2);
407 + ns, ansp, ansp2, nansp2, resplen2,
411 if (n == 0 && (buf2 == NULL || *resplen2 == 0))
412 @@ -575,7 +576,7 @@ __libc_res_nsend(res_state statp, const
413 n = send_dg(statp, buf, buflen, buf2, buflen2,
414 &ans, &anssiz, &terrno,
415 ns, &v_circuit, &gotsomewhere, ansp,
416 - ansp2, nansp2, resplen2);
417 + ansp2, nansp2, resplen2, ansp2_malloced);
420 if (n == 0 && (buf2 == NULL || *resplen2 == 0))
421 @@ -665,7 +666,7 @@ res_nsend(res_state statp,
422 const u_char *buf, int buflen, u_char *ans, int anssiz)
424 return __libc_res_nsend(statp, buf, buflen, NULL, 0, ans, anssiz,
425 - NULL, NULL, NULL, NULL);
426 + NULL, NULL, NULL, NULL, NULL);
428 libresolv_hidden_def (res_nsend)
430 @@ -747,7 +748,7 @@ send_vc(res_state statp,
431 const u_char *buf, int buflen, const u_char *buf2, int buflen2,
432 u_char **ansp, int *anssizp,
433 int *terrno, int ns, u_char **anscp, u_char **ansp2, int *anssizp2,
435 + int *resplen2, int *ansp2_malloced)
437 const HEADER *hp = (HEADER *) buf;
438 const HEADER *hp2 = (HEADER *) buf2;
439 @@ -896,6 +897,8 @@ send_vc(res_state statp,
441 *thisanssizp = MAXPACKET;
443 + if (thisansp == ansp2)
444 + *ansp2_malloced = 1;
445 anhp = (HEADER *) newp;
446 /* A uint16_t can't be larger than MAXPACKET
447 thus it's safe to allocate MAXPACKET but
448 @@ -1128,7 +1131,7 @@ send_dg(res_state statp,
449 const u_char *buf, int buflen, const u_char *buf2, int buflen2,
450 u_char **ansp, int *anssizp,
451 int *terrno, int ns, int *v_circuit, int *gotsomewhere, u_char **anscp,
452 - u_char **ansp2, int *anssizp2, int *resplen2)
453 + u_char **ansp2, int *anssizp2, int *resplen2, int *ansp2_malloced)
455 const HEADER *hp = (HEADER *) buf;
456 const HEADER *hp2 = (HEADER *) buf2;
457 @@ -1289,6 +1292,8 @@ send_dg(res_state statp,
459 *thisanssizp = MAXPACKET;
461 + if (thisansp == ansp2)
462 + *ansp2_malloced = 1;
465 /* We could end up with truncation if anscp was NULL