diff options
| author | Florian Weimer <fweimer@redhat.com> | 2014-12-15 17:41:13 +0100 |
|---|---|---|
| committer | Adhemerval Zanella <azanella@linux.vnet.ibm.com> | 2015-01-16 07:10:42 -0500 |
| commit | 612b11da56d9cd77a7125e4de984127ee7b52de6 (patch) | |
| tree | d63db3e34ad6857a27a4f22585642f3f77d4381c | |
| parent | 955edb2d28e14fd86d57a2877cde15094a882932 (diff) | |
| download | glibc-612b11da56d9cd77a7125e4de984127ee7b52de6.zip glibc-612b11da56d9cd77a7125e4de984127ee7b52de6.tar.gz glibc-612b11da56d9cd77a7125e4de984127ee7b52de6.tar.bz2 | |
Avoid infinite loop in nss_dns getnetbyname [BZ #17630]
| -rw-r--r-- | ChangeLog | 6 | ||||
| -rw-r--r-- | NEWS | 5 | ||||
| -rw-r--r-- | resolv/nss_dns/dns-network.c | 4 |
3 files changed, 12 insertions, 3 deletions
@@ -1,3 +1,9 @@ +2014-12-16 Florian Weimer <fweimer@redhat.com> + + [BZ #17630] + * resolv/nss_dns/dns-network.c (getanswer_r): Iterate over alias + names. + 2014-12-15 Jeff Law <law@redhat.com> [BZ #16617] @@ -11,13 +11,16 @@ Version 2.18.1 14143, 14155, 14547, 14699, 15532, 15427, 15522, 15680, 15723, 15734, 15735, 15797, 15892, 15895, 15909, 15915, 15917, 15996, 16072, 16150, - 16414, 16430, 16431, 16617, 17048, 17137, 17187, 17325. + 16414, 16430, 16431, 16617, 17048, 17137, 17187, 17325, 17630. * Support for powerpc64le has been added. * CVE-2012-3406 printf-style functions could run into a stack overflow when processing format strings with a large number of format specifiers. +* The nss_dns implementation of getnetbyname could run into an infinite loop + if the DNS response contained a PTR record of an unexpected format. + * CVE-2014-4043 The posix_spawn_file_actions_addopen implementation did not copy the path argument. This allowed programs to cause posix_spawn to deference a dangling pointer, or use an unexpected pathname argument if diff --git a/resolv/nss_dns/dns-network.c b/resolv/nss_dns/dns-network.c index 3c4db7e..7507f8c 100644 --- a/resolv/nss_dns/dns-network.c +++ b/resolv/nss_dns/dns-network.c @@ -398,8 +398,8 @@ getanswer_r (const querybuf *answer, int anslen, struct netent *result, case BYNAME: { - char **ap = result->n_aliases++; - while (*ap != NULL) + char **ap; + for (ap = result->n_aliases; *ap != NULL; ++ap) { /* Check each alias name for being of the forms: 4.3.2.1.in-addr.arpa = net 1.2.3.4 |