Avoid infinite loop in nss_dns getnetbyname [BZ #17630]

(cherry picked from commit 11e3417af6e354f1942c68a271ae51e892b2814d)
(cherry picked from commit e54db0ea6a49affac43fa305fd134f3020c41382)

Conflicts:
	NEWS

diff --git a/ChangeLog b/ChangeLog
index 88d2f1edde7d984fb0839cfcf3802888d0adc97e..e416cd0e62c608b130b270599ff70efb984c76ed 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2014-12-16  Florian Weimer  <fweimer@redhat.com>
+
+       [BZ #17630]
+       * resolv/nss_dns/dns-network.c (getanswer_r): Iterate over alias
+       names.
+
 2014-12-15  Jeff Law  <law@redhat.com>
 
        [BZ #16617]

diff --git a/NEWS b/NEWS
index f6cdb661422102a5a757f154ee27f9b313f2e007..9bc835c4d173eab96d1ecbb400082afced13fe29 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -9,7 +9,7 @@ Version 2.20.1
 
 * The following bugs are resolved with this release:
 
-  16617, 17266, 17370, 17371, 17460, 17485, 17555, 17625.
+  16617, 17266, 17370, 17371, 17460, 17485, 17555, 17625, 17630.
 
 * CVE-2104-7817 The wordexp function could ignore the WRDE_NOCMD flag
   under certain input conditions resulting in the execution of a shell for
@@ -18,7 +18,11 @@ Version 2.20.1
   shell and returns the error WRDE_CMDSUB as expected.
 
 * CVE-2012-3406 printf-style functions could run into a stack overflow when
-  processing format strings with a large number of format specifiers.a
+  processing format strings with a large number of format specifiers.
+
+* CVE-2014-9402 The nss_dns implementation of getnetbyname could run into an
+  infinite loopif the DNS response contained a PTR record of an unexpected
+  format.
 \f
 Version 2.20
 

diff --git a/resolv/nss_dns/dns-network.c b/resolv/nss_dns/dns-network.c
index 0a77c8bc4808a0974591f69845e6fec3b277d267..08cf0a6462ce9bb12ea04507041b5958a1ea24e3 100644 (file)
--- a/resolv/nss_dns/dns-network.c
+++ b/resolv/nss_dns/dns-network.c
@@ -398,8 +398,8 @@ getanswer_r (const querybuf *answer, int anslen, struct netent *result,
 
        case BYNAME:
          {
-           char **ap = result->n_aliases++;
-           while (*ap != NULL)
+           char **ap;
+           for (ap = result->n_aliases; *ap != NULL; ++ap)
              {
                /* Check each alias name for being of the forms:
                   4.3.2.1.in-addr.arpa         = net 1.2.3.4