From c7093fd0fedd8a0b4ed5b01347e3798219ba22ec Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Mon, 15 Dec 2014 17:41:13 +0100 Subject: [PATCH] Avoid infinite loop in nss_dns getnetbyname [BZ #17630] --- ChangeLog | 6 ++++++ NEWS | 5 ++++- resolv/nss_dns/dns-network.c | 4 ++-- 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 7e859833dc7..e64ffd1c5ef 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2014-12-16 Florian Weimer + + [BZ #17630] + * resolv/nss_dns/dns-network.c (getanswer_r): Iterate over alias + names. + 2014-12-15 Jeff Law [BZ #16617] diff --git a/NEWS b/NEWS index cbac49229fe..49909f1834a 100644 --- a/NEWS +++ b/NEWS @@ -10,7 +10,10 @@ Version 2.16.1 * The following bugs are resolved with this release: 6530, 14195, 14547, 14459, 14476, 14562, 14621, 14648, 14699, 14756, 14831, - 15078, 15754, 15755, 16072, 16617, 17048, 17137, 17187, 17325. + 15078, 15754, 15755, 16072, 16617, 17048, 17137, 17187, 17325, 17630. + +* The nss_dns implementation of getnetbyname could run into an infinite loop + if the DNS response contained a PTR record of an unexpected format. * CVE-2012-3406 printf-style functions could run into a stack overflow when processing format strings with a large number of format specifiers. diff --git a/resolv/nss_dns/dns-network.c b/resolv/nss_dns/dns-network.c index 4c590babae4..d101306099a 100644 --- a/resolv/nss_dns/dns-network.c +++ b/resolv/nss_dns/dns-network.c @@ -398,8 +398,8 @@ getanswer_r (const querybuf *answer, int anslen, struct netent *result, case BYNAME: { - char **ap = result->n_aliases++; - while (*ap != NULL) + char **ap; + for (ap = result->n_aliases; *ap != NULL; ++ap) { /* Check each alias name for being of the forms: 4.3.2.1.in-addr.arpa = net 1.2.3.4 -- 2.47.2