CVE-2015-1781: resolv/nss_dns/dns-host.c buffer overflow [BZ#18287]

Conflicts:
	NEWS
	resolv/nss_dns/dns-host.c

diff --git a/ChangeLog b/ChangeLog
index fc104eb85b7d1ec9a3def5a962001850213051d2..d287261023aa74be1b4c61396796d5c86477b1fa 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2015-04-21  Arjun Shankar  <arjun.is@lostca.se>
+
+       [BZ #18287]
+       * resolv/nss_dns/dns-host.c (getanswer_r): Adjust buffer length
+       based on padding.  (CVE-2015-1781)
+
 2015-03-10  Adhemerval Zanella  <azanella@linux.vnet.ibm.com>
 
        * sysdeps/ieee754/dbl-64/Makefile (CFLAGS-e_pow.c): Add

diff --git a/NEWS b/NEWS
index 3af0fb6461de1a3d00b6b3fbe0c39e42176be896..fbd25a119c45ebcaad6b4b8ebee775905ffb5693 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -12,7 +12,14 @@ Version 2.19.1
   15946, 16545, 16574, 16617, 16618, 16683, 16689, 16695, 16701, 16706,
   16707, 16739, 16815, 16619, 16740, 16878, 16882, 16885, 16916, 16932,
   16943, 16958, 17031, 17048, 17069, 17137, 17153, 17187, 17213, 17263,
-  17325, 17555, 17625, 17630, 18104.
+  17325, 17555, 17625, 17630, 18104, 18287.
+
+* A buffer overflow in gethostbyname_r and related functions performing DNS
+  requests has been fixed.  If the NSS functions were called with a
+  misaligned buffer, the buffer length change due to pointer alignment was
+  not taken into account.  This could result in application crashes or,
+  potentially arbitrary code execution, using crafted, but syntactically
+  valid DNS responses.  (CVE-2015-1781)
 
 * CVE-2104-7817 The wordexp function could ignore the WRDE_NOCMD flag
   under certain input conditions resulting in the execution of a shell for

diff --git a/resolv/nss_dns/dns-host.c b/resolv/nss_dns/dns-host.c
index f0b4b17b0651a626189774d54858039ec1817c42..f36d28bd7078df318123d34b93ad2ad8b10f8e51 100644 (file)
--- a/resolv/nss_dns/dns-host.c
+++ b/resolv/nss_dns/dns-host.c
@@ -615,7 +615,8 @@ getanswer_r (const querybuf *answer, int anslen, const char *qname, int qtype,
   int have_to_map = 0;
   uintptr_t pad = -(uintptr_t) buffer % __alignof__ (struct host_data);
   buffer += pad;
-  if (__builtin_expect (buflen < sizeof (struct host_data) + pad, 0))
+  buflen = buflen > pad ? buflen - pad : 0;
+  if (__builtin_expect (buflen < sizeof (struct host_data), 0))
     {
       /* The buffer is too small.  */
     too_small: