diff options
| author | Florian Weimer <fweimer@redhat.com> | 2016-04-27 17:15:57 +0200 |
|---|---|---|
| committer | Mike Frysinger <vapier@gentoo.org> | 2016-11-12 00:44:27 -0500 |
| commit | 742bcfaa70ea522406dd046adafefa933d29ca50 (patch) | |
| tree | e7833d69dc7d9e96b5120e3ad2defd8e56462b5f | |
| parent | b7d81292bf651f176790011e83338a496dc9e778 (diff) | |
| download | glibc-742bcfaa70ea522406dd046adafefa933d29ca50.zip glibc-742bcfaa70ea522406dd046adafefa933d29ca50.tar.gz glibc-742bcfaa70ea522406dd046adafefa933d29ca50.tar.bz2 | |
nss_dns: Skip over non-PTR records in the netent code [BZ #19868]
This requires additional checks for the RDATA length and the
availability of record metadata.
(cherry picked from commit a12f9431b3808e78b9ed397e4fce7de69410d94d)
(cherry picked from commit 1e5ac8a1daa360cd9632e5056e4bdf29e18ac2c7)
| -rw-r--r-- | resolv/nss_dns/dns-network.c | 20 |
1 files changed, 18 insertions, 2 deletions
diff --git a/resolv/nss_dns/dns-network.c b/resolv/nss_dns/dns-network.c index 8f301a7..ad6acff 100644 --- a/resolv/nss_dns/dns-network.c +++ b/resolv/nss_dns/dns-network.c @@ -345,10 +345,23 @@ getanswer_r (const querybuf *answer, int anslen, struct netent *result, if (n < 0 || res_dnok (bp) == 0) break; cp += n; + + if (end_of_message - cp < 10) + { + __set_h_errno (NO_RECOVERY); + return NSS_STATUS_UNAVAIL; + } + GETSHORT (type, cp); GETSHORT (class, cp); cp += INT32SZ; /* TTL */ - GETSHORT (n, cp); + uint16_t rdatalen; + GETSHORT (rdatalen, cp); + if (end_of_message - cp < rdatalen) + { + __set_h_errno (NO_RECOVERY); + return NSS_STATUS_UNAVAIL; + } if (class == C_IN && type == T_PTR) { @@ -370,7 +383,7 @@ getanswer_r (const querybuf *answer, int anslen, struct netent *result, cp += n; return NSS_STATUS_UNAVAIL; } - cp += n; + cp += rdatalen; if (alias_pointer + 2 < &net_data->aliases[MAX_NR_ALIASES]) { *alias_pointer++ = bp; @@ -381,6 +394,9 @@ getanswer_r (const querybuf *answer, int anslen, struct netent *result, ++have_answer; } } + else + /* Skip over unknown record data. */ + cp += rdatalen; } if (have_answer) |