From: Florian Weimer Date: Mon, 15 Dec 2014 16:41:13 +0000 (+0100) Subject: Avoid infinite loop in nss_dns getnetbyname [BZ #17630] X-Git-Tag: glibc-2.21~224 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=11e3417af6e354f1942c68a271ae51e892b2814d;p=thirdparty%2Fglibc.git Avoid infinite loop in nss_dns getnetbyname [BZ #17630] --- diff --git a/ChangeLog b/ChangeLog index a0a11e8a625..ee147e297fe 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2014-12-16 Florian Weimer + + [BZ #17630] + * resolv/nss_dns/dns-network.c (getanswer_r): Iterate over alias + names. + 2014-12-16 Allan McRae * stdio-common/Makefile (tests): Re-add bug26. diff --git a/NEWS b/NEWS index 3556ecda2b8..11121cacb06 100644 --- a/NEWS +++ b/NEWS @@ -13,8 +13,8 @@ Version 2.21 15884, 16469, 16617, 16619, 16657, 16740, 16857, 17192, 17266, 17344, 17363, 17370, 17371, 17411, 17460, 17475, 17485, 17501, 17506, 17508, 17522, 17555, 17570, 17571, 17572, 17573, 17574, 17581, 17582, 17583, - 17584, 17585, 17589, 17594, 17601, 17608, 17616, 17625, 17633, 17634, - 17647, 17653, 17657, 17664, 17665, 17668, 17682. + 17584, 17585, 17589, 17594, 17601, 17608, 17616, 17625, 17630, 17633, + 17634, 17647, 17653, 17657, 17664, 17665, 17668, 17682. * CVE-2104-7817 The wordexp function could ignore the WRDE_NOCMD flag under certain input conditions resulting in the execution of a shell for @@ -25,6 +25,9 @@ Version 2.21 * CVE-2012-3406 printf-style functions could run into a stack overflow when processing format strings with a large number of format specifiers. +* The nss_dns implementation of getnetbyname could run into an infinite loop + if the DNS response contained a PTR record of an unexpected format. + * The minimum GCC version that can be used to build this version of the GNU C Library is GCC 4.6. Older GCC versions, and non-GNU compilers, can still be used to compile programs using the GNU C Library. diff --git a/resolv/nss_dns/dns-network.c b/resolv/nss_dns/dns-network.c index 0a77c8bc480..08cf0a6462c 100644 --- a/resolv/nss_dns/dns-network.c +++ b/resolv/nss_dns/dns-network.c @@ -398,8 +398,8 @@ getanswer_r (const querybuf *answer, int anslen, struct netent *result, case BYNAME: { - char **ap = result->n_aliases++; - while (*ap != NULL) + char **ap; + for (ap = result->n_aliases; *ap != NULL; ++ap) { /* Check each alias name for being of the forms: 4.3.2.1.in-addr.arpa = net 1.2.3.4