CVE-2015-1781: resolv/nss_dns/dns-host.c buffer overflow [BZ#18287]

(cherry picked from commit 2959eda9272a033863c271aff62095abd01bd4e3)

diff --git a/ChangeLog b/ChangeLog
index b88cd041d3467bcba73ebd418838b767803856ba..0eb6c3f0a1fa92086005657d0d2b6fe6f03d0ef0 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2015-04-21  Arjun Shankar  <arjun.is@lostca.se>
+
+       [BZ #18287]
+       * resolv/nss_dns/dns-host.c (getanswer_r): Adjust buffer length
+       based on padding.  (CVE-2015-1781)
+
 2014-12-11  Andreas Schwab  <schwab@suse.de>
 
        [BZ #16657]

diff --git a/NEWS b/NEWS
index 6f240cd5e72893bc5978fa1b56bf6f97ae9b1a5c..7f9388fec9762b4153b3c3c09af8d450a8a6f3d7 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -10,7 +10,15 @@ Version 2.19.1
 * The following bugs are resolved with this release:
 
   15946, 16545, 16574, 16623, 16657, 16695, 16878, 16882, 16885, 16916,
-  16932, 16943, 16958, 17048, 17069, 17137, 17213, 17263, 17325, 17555.
+  16932, 16943, 16958, 17048, 17069, 17137, 17213, 17263, 17325, 17555,
+  18287.
+
+* A buffer overflow in gethostbyname_r and related functions performing DNS
+  requests has been fixed.  If the NSS functions were called with a
+  misaligned buffer, the buffer length change due to pointer alignment was
+  not taken into account.  This could result in application crashes or,
+  potentially arbitrary code execution, using crafted, but syntactically
+  valid DNS responses.  (CVE-2015-1781)
 
 * Reverted change of ABI data structures for s390 and s390x:
   On s390 and s390x the size of struct ucontext and jmp_buf was increased in

diff --git a/resolv/nss_dns/dns-host.c b/resolv/nss_dns/dns-host.c
index f0b4b17b0651a626189774d54858039ec1817c42..f36d28bd7078df318123d34b93ad2ad8b10f8e51 100644 (file)
--- a/resolv/nss_dns/dns-host.c
+++ b/resolv/nss_dns/dns-host.c
@@ -615,7 +615,8 @@ getanswer_r (const querybuf *answer, int anslen, const char *qname, int qtype,
   int have_to_map = 0;
   uintptr_t pad = -(uintptr_t) buffer % __alignof__ (struct host_data);
   buffer += pad;
-  if (__builtin_expect (buflen < sizeof (struct host_data) + pad, 0))
+  buflen = buflen > pad ? buflen - pad : 0;
+  if (__builtin_expect (buflen < sizeof (struct host_data), 0))
     {
       /* The buffer is too small.  */
     too_small: