aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2016-04-22resolv: Always set *resplen2 out parameter in send_dg [BZ #19791]release/2.18/masterFlorian Weimer3-24/+51
Since commit 44d20bca52ace85850012b0ead37b360e3ecd96e (Implement second fallback mode for DNS requests), there is a code path which returns early, before *resplen2 is initialized. This happens if the name server address is immediately recognized as invalid (because of lack of protocol support, or if it is a broadcast address such 255.255.255.255, or another invalid address). If this happens and *resplen2 was non-zero (which is the case if a previous query resulted in a failure), __libc_res_nquery would reuse an existing second answer buffer. This answer has been previously identified as unusable (for example, it could be an NXDOMAIN response). Due to the presence of a second answer, no name server switching will occur. The result is a name resolution failure, although a successful resolution would have been possible if name servers have been switched and queries had proceeded along the search path. The above paragraph still simplifies the situation. Before glibc 2.23, if the second answer needed malloc, the stub resolver would still attempt to reuse the second answer, but this is not possible because __libc_res_nsearch has freed it, after the unsuccessful call to __libc_res_nquerydomain, and set the buffer pointer to NULL. This eventually leads to an assertion failure in __libc_res_nquery: /* Make sure both hp and hp2 are defined */ assert((hp != NULL) && (hp2 != NULL)); If assertions are disabled, the consequence is a NULL pointer dereference on the next line. Starting with glibc 2.23, as a result of commit e9db92d3acfe1822d56d11abcea5bfc4c41cf6ca (CVE-2015-7547: getaddrinfo() stack-based buffer overflow (Bug 18665)), the second answer is always allocated with malloc. This means that the assertion failure happens with small responses as well because there is no buffer to reuse, as soon as there is a name resolution failure which triggers a search for an answer along the search path. This commit addresses the issue by ensuring that *resplen2 is initialized before the send_dg function returns. This commit also addresses a bug where an invalid second reply is incorrectly returned as a valid to the caller. (cherry picked from commit b66d837bb5398795c6b0f651bd5a5d66091d8577)
2016-04-22Fix invalid file descriptor reuse while sending DNS query (BZ #15946)Andreas Schwab3-2/+9
(cherry picked from commit 45af2f6fe19b8a776373cac5a2691460179aa1a3)
2016-04-22CVE-2015-7547: getaddrinfo() stack-based buffer overflow (Bug 18665).Carlos O'Donell5-64/+343
* A stack-based buffer overflow was found in libresolv when invoked from libnss_dns, allowing specially crafted DNS responses to seize control of execution flow in the DNS client. The buffer overflow occurs in the functions send_dg (send datagram) and send_vc (send TCP) for the NSS module libnss_dns.so.2 when calling getaddrinfo with AF_UNSPEC family. The use of AF_UNSPEC triggers the low-level resolver code to send out two parallel queries for A and AAAA. A mismanagement of the buffers used for those queries could result in the response of a query writing beyond the alloca allocated buffer created by _nss_dns_gethostbyname4_r. Buffer management is simplified to remove the overflow. Thanks to the Google Security Team and Red Hat for reporting the security impact of this issue, and Robert Holiday of Ciena for reporting the related bug 18665. (CVE-2015-7547) See also: https://sourceware.org/ml/libc-alpha/2016-02/msg00416.html https://sourceware.org/ml/libc-alpha/2016-02/msg00418.html (cherry picked from commit e9db92d3acfe1822d56d11abcea5bfc4c41cf6ca)
2015-12-31Fix memory handling in strxfrm_l [BZ #16009]Leonhard Holz5-104/+473
[Modified from the original email by Siddhesh Poyarekar] This patch solves bug #16009 by implementing an additional path in strxfrm that does not depend on caching the weight and rule indices. In detail the following changed: * The old main loop was factored out of strxfrm_l into the function do_xfrm_cached to be able to alternativly use the non-caching version do_xfrm. * strxfrm_l allocates a a fixed size array on the stack. If this is not sufficiant to store the weight and rule indices, the non-caching path is taken. As the cache size is not dependent on the input there can be no problems with integer overflows or stack allocations greater than __MAX_ALLOCA_CUTOFF. Note that malloc-ing is not possible because the definition of strxfrm does not allow an oom errorhandling. * The uncached path determines the weight and rule index for every char and for every pass again. * Passing all the locale data array by array resulted in very long parameter lists, so I introduced a structure that holds them. * Checking for zero src string has been moved a bit upwards, it is before the locale data initialization now. * To verify that the non-caching path works correct I added a test run to localedata/sort-test.sh & localedata/xfrm-test.c where all strings are patched up with spaces so that they are too large for the caching path. (cherry picked from commit 0f9e585480edcdf1e30dc3d79e24b84aeee516fa) Conflicts: NEWS string/strxfrm_l.c
2015-12-30Fix BZ #17269 -- _IO_wstr_overflow integer overflowPaul Pluzhnikov3-2/+14
(cherry picked from commit bdf1ff052a8e23d637f2c838fa5642d78fcedc33) Conflicts: NEWS
2015-12-30Fix read past end of pattern in fnmatch (bug 18032)Andreas Schwab4-4/+42
(cherry picked from commit 4a28f4d55a6cc33474c0792fe93b5942d81bf185) Conflicts: NEWS posix/tst-fnmatch3.c
2015-12-30Harden tls_dtor_list with pointer mangling [BZ #19018]Florian Weimer3-3/+18
(cherry picked from commit f586e1328681b400078c995a0bb6ad301ef73549) Conflicts: NEWS stdlib/cxa_thread_atexit_impl.c
2015-12-30Always enable pointer guard [BZ #18928]Florian Weimer4-15/+18
Honoring the LD_POINTER_GUARD environment variable in AT_SECURE mode has security implications. This commit enables pointer guard unconditionally, and the environment variable is now ignored. [BZ #18928] * sysdeps/generic/ldsodefs.h (struct rtld_global_ro): Remove _dl_pointer_guard member. * elf/rtld.c (_rtld_global_ro): Remove _dl_pointer_guard initializer. (security_init): Always set up pointer guard. (process_envvars): Do not process LD_POINTER_GUARD. (cherry picked from commit a014cecd82b71b70a6a843e250e06b541ad524f7) Conflicts: NEWS
2014-06-03Fixed pthread_spin_lock on sparc32/64 (bug 16882)Guo Yixuan6-6/+126
[BZ #16882] * nptl/sysdeps/sparc/sparc32/pthread_spin_lock.S (pthread_spin_lock): Branch out of spin loop to proper location. * nptl/sysdeps/sparc/sparc64/pthread_spin_lock.S (pthread_spin_lock): Likewise. * nptl/tst-spin4.c: New test. * nptl/Makefile (tests): Add tst-spin4.
2014-05-17Fix sparc memcpy data corruption when using niagara2 optimized routines.Jose E. Marchesi3-1/+8
* sysdeps/sparc/sparc64/multiarch/memcpy-niagara2.S: Add missing membar to avoid block loads/stores to overlap previous stores.
2014-05-16SPARC: add prlimit and prlimit64 in <bits/resource.h> (BZ #16943)Aurelien Jarno3-1/+35
prlimit and prlimit64 have been added in the main <bits/resource.h>, but not in the SPARC specific version. Fix that. Note: this is Debian bug#703559, reported by Emilio Pozuelo Monfort <pochu@debian.org> (cherry picked from commit d16e6ec7ca2c861ba681e3a2fbd431725774292e)
2014-05-07SPARC: add EFD_SEMAPHORE in <bits/eventfd.h> (BZ #16916)Aurelien Jarno3-1/+9
EFD_SEMAPHORE has been added in the main <bits/eventfd.h>, but not in the SPARC specific version. Fix that. (cherry picked from commit 83df9ad0cc861ef24f08a88c5a4c055e2516d33c)
2014-05-01NEWS: Add 16885 to fixed bug list.David S. Miller1-1/+1
2014-05-01Fix v9/64-bit strcmp when string ends in multiple zero bytes.David S. Miller3-0/+69
[BZ #16885] * sysdeps/sparc/sparc64/strcmp.S: Fix end comparison handling when multiple zero bytes exist at the end of a string. Reported by Aurelien Jarno <aurelien@aurel32.net> * string/test-strcmp.c (check): Add explicit test for situations where there are multiple zero bytes after the first.
2014-01-29Disable x87 inline functions for SSE2 mathH.J. Lu3-4/+10
When i386 and x86-64 mathinline.h was merged into a single mathinline.h, "gcc -m32" enables x87 inline functions on x86-64 even when -mfpmath=sse and SSE2 is enabled. It is a regression on x86-64. We should check __SSE2_MATH__ instead of __x86_64__ when disabling x87 inline functions. (cherry picked from commit 409e00bd69b8d8dd74d7327085351d26769ea6fc) Conflicts: ChangeLog NEWS
2014-01-21[AArch64] BZ #16169 Add CFI directives to clone.STom Tromey3-2/+13
[BZ #16169] Add CFI directives to the AArch64 clone.S implementation and ensure that the FP in the child is zero'd in order to comply with AAPCS. (cherry picked from commit 3a3acb6afc753475675b5724f206e619d0c9590d) Conflicts: NEWS
2014-01-20Include generic symbol-hacks.h for x32H.J. Lu2-1/+6
In BZ #15605 fix with addding memset/memmove alias in symbol-hacks.h, x32 symbol-hacks.h change was missing. Fixed by including <sysdeps/generic/symbol-hacks.h> in x32 symbol-hacks.h.
2014-01-07[AArch64] Fix FP_ROUNDMODE.Marcus Shawcroft4-2/+12
[BZ #16387] Fix FP_ROUNDMODE to extract the correct bits from FPCR. Conflicts: NEWS
2014-01-07[AArch64] Fix CFA adjustment on dynamic linker entry.Marcus Shawcroft2-1/+6
2014-01-05Fix race in free() of fastbin chunk: BZ #15073Maxim Kuvyrkov3-9/+20
Perform sanity check only if we have_lock. Due to lockless nature of fastbins we need to be careful derefencing pointers to fastbin entries (chunksize(old) in this case) in multithreaded environments. The fix is to add have_lock to the if-condition checks. The rest of the patch only makes code more readable. * malloc/malloc.c (_int_free): Perform sanity check only if we have_lock. Conflicts: ChangeLog NEWS
2013-12-19[AArch64] Save and restore q0-q7 on entry to dynamic linker.Marcus Shawcroft3-5/+31
[BZ #15128] Ensure all argument passing registers are saved and restored on entry to dynamic linker. (cherry picked from commit 9dbebe1a67bbedfcb39c6b739f15bc639e8d40a2) Conflicts: NEWS
2013-11-17alpha: Fix signal thunk unwind infoRichard Henderson2-4/+19
2013-11-12Fix sparc 64-bit GMP ifunc resolution in static builds.David S. Miller7-6/+16
[BZ #16150] * sysdeps/sparc/sparc64/multiarch/add_n.S: Resolve to the correct generic symbol in the non-vis3 case in static builds. * sysdeps/sparc/sparc64/multiarch/addmul_1.S: Likewise. * sysdeps/sparc/sparc64/multiarch/mul_1.S: Likewise. * sysdeps/sparc/sparc64/multiarch/sub_n.S: Likewise. * sysdeps/sparc/sparc64/multiarch/submul_1.S: Likewise.
2013-11-07Fix build on pre-v9 32-bit Sparc.David S. Miller3-2/+9
We cannot use fnegd in this code, as fnegd was added in v9. Only fnegs exists in v8 and earlier. [BZ #15985] * sysdeps/sparc/sparc32/fpu/s_fdim.S (__fdim): Do not use fnegd on pre-v9 cpus, use a fnegs+fmovs sequence instead.
2013-10-03Fix PI mutex check in pthread_cond_broadcast and pthread_cond_signalSiddhesh Poyarekar4-11/+12
Fixes BZ #15996. The check had a typo - it checked for PTHREAD_MUTEX_ROBUST_NP instead of PTHREAD_MUTEX_ROBUST_NORMAL_NP. It has now been replaced by the already existing convenience macro USE_REQUEUE_PI.
2013-09-06Update Chinese (traditional) translations.David S. Miller2-941/+980
* po/zh_TW.po: Update Chinese (traditional) translation from translation project.
2013-08-30ARM: Fix clone code when built for Thumb.Will Newton3-2/+14
The mov lr, pc instruction will lose the Thumb bit from the return address so use blx lr instead. ports/ChangeLog.arm: 2013-08-30 Will Newton <will.newton@linaro.org> [BZ #15909] * sysdeps/unix/sysv/linux/arm/clone.S (__clone): Use blx instead of mov lr, pc. (cherry picked from commit 6b06ac56cdfc9293908724e51e827534e97819aa)
2013-08-23Add Ukrainian translations.David S. Miller2-0/+7152
* po/uk.po: Add Ukrainian translations from translation project.
2013-08-22Update Catalan translations.David S. Miller2-934/+972
* po/ca.po: Update Catalan translation from translation project.
2013-08-10Update version.h and include/features.h for 2.18 release.glibc-2.18David S. Miller2-3/+3
2013-08-06Fix typo in ChangeLogAndreas Schwab1-1/+1
2013-08-03Update Korean translations.David S. Miller2-1143/+1342
* po/ko.po: Update Korean translation from translation project.
2013-08-01Update manual/contrib.texiDavid S. Miller2-1/+21
* manual/contrib.texi: Update entry for Siddhesh Poyarekar. Add entries for Will Newton, Andi Kleen, David Holsgrove, and Ondrej Bilka.
2013-07-30Update French translations.David S. Miller2-934/+972
* po/fr.po: Update French translation from translation project.
2013-07-28Update Czech translations.David S. Miller2-937/+972
* po/cs.po: Update Czech translation from translation project.
2013-07-28Update Swedish translations.David S. Miller2-935/+973
* po/sv.po: Update Swedish translation from translation project.
2013-07-27Update Esperanto translations.David S. Miller2-1020/+1054
* po/eo.po: Update Esperanto translation from translation project.
2013-07-27Update Vietnamese translations.David S. Miller2-992/+1029
* po/vi.po: Update Vietnamese translation from translation project.
2013-07-27Update German translations.David S. Miller2-933/+971
* po/de.po: Update German translation from translation project.
2013-07-26Update Bulgarian translations.David S. Miller2-946/+982
* po/bg.po: Update Bulgarian translation from translation project.
2013-07-26Update Dutch, Polish, and Russian translations.David S. Miller4-2819/+2927
* po/nl.po: Update Dutch translation from translation project. * po/pl.po: Update Polish translation from translation project. * po/ru.po: Update Russian translation from translation project.
2013-07-26[AArch64] Provide symbol version for _mcount.Marcus Shawcroft5-0/+81
2013-07-25Update libc.pot in preparation for giving tarball to translation project.David S. Miller2-930/+968
* po/libc.pot: Update.
2013-07-25Added NEWS entries for AT_HWCAP2 and POWER8 enablement.Ryan S. Arnold1-0/+5
2013-07-23hppa: Regenerate libm-test-ulps.Carlos O'Donell2-0/+43
2013-07-23Remove Linux kernel version ambiguity in comment added by previous commit.David S. Miller2-2/+6
* tst-cancel4.c (WRITE_BUFFER_SIZE): Adjust comment.
2013-07-23PowerPC: use _dl_static_init to set GLRO(gl_pagesize)Adhemerval Zanella5-0/+137
This patch fixes dlfcn/tststatic5 for PowerPC where pagesize variable was not properly initialized in certain cases. This patch is based on other architecture code.
2013-07-23Increase nptl test case buffer size so we really block on current Linux kernels.David S. Miller2-1/+28
* tst-cancel4.c (WRITE_BUFFER_SIZE): Increase to 16384.
2013-07-22tile BZ #15759: Fix bug in _dl_unmapChris Metcalf3-4/+17
We returned without calling __munmap if not in the simulator. Now we call a separate sim_dlclose() function to make the control flow work correctly.
2013-07-22S/390: ULPs update.Andreas Krebbel2-141/+6289
generated by cgit v1.1 at 2025-03-31 22:24:38 +0000