From: Florian Weimer Date: Mon, 15 Dec 2014 16:41:13 +0000 (+0100) Subject: Avoid infinite loop in nss_dns getnetbyname [BZ #17630] X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d2a6f3a27b791d91beec2ea91f293ec898080904;p=thirdparty%2Fglibc.git Avoid infinite loop in nss_dns getnetbyname [BZ #17630] --- diff --git a/ChangeLog b/ChangeLog index fc394119c75..f66dfe32c64 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2014-12-16 Florian Weimer + + [BZ #17630] + * resolv/nss_dns/dns-network.c (getanswer_r): Iterate over alias + names. + 2014-12-15 Jeff Law [BZ #16617] diff --git a/NEWS b/NEWS index 1f830252cf5..c96992473b1 100644 --- a/NEWS +++ b/NEWS @@ -10,7 +10,7 @@ Version 2.19.1 * The following bugs are resolved with this release: 16545, 16617, 16683, 16689, 16701, 16706, 16707, 16739, 16815, 16619, - 16740, 17031, 17048, 17137, 17153, 17187, 17213, 17325. + 16740, 17031, 17048, 17137, 17153, 17187, 17213, 17325, 17630. * Decoding a crafted input sequence in the character sets IBM933, IBM935, IBM937, IBM939, IBM1364 could result in an out-of-bounds array read, @@ -41,6 +41,9 @@ Version 2.19.1 * CVE-2012-3406 printf-style functions could run into a stack overflow when processing format strings with a large number of format specifiers. + +* The nss_dns implementation of getnetbyname could run into an infinite loop + if the DNS response contained a PTR record of an unexpected format. Version 2.19 diff --git a/resolv/nss_dns/dns-network.c b/resolv/nss_dns/dns-network.c index 8e80a6010e1..60c94f38a4d 100644 --- a/resolv/nss_dns/dns-network.c +++ b/resolv/nss_dns/dns-network.c @@ -398,8 +398,8 @@ getanswer_r (const querybuf *answer, int anslen, struct netent *result, case BYNAME: { - char **ap = result->n_aliases++; - while (*ap != NULL) + char **ap; + for (ap = result->n_aliases; *ap != NULL; ++ap) { /* Check each alias name for being of the forms: 4.3.2.1.in-addr.arpa = net 1.2.3.4