wok-4.x view glibc/stuff/patches/glibc-2.22-CVE-2016-3706.patch @ rev 12476
Up glibc (2.22) with CVE patchs
| author | Stanislas Leduc <shann@slitaz.org> |
|---|---|
| date | Wed Mar 15 11:41:38 2023 +0000 (14 months ago) |
| parents | |
| children |
line source
1 From 4ab2ab03d4351914ee53248dc5aef4a8c88ff8b9 Mon Sep 17 00:00:00 2001
2 From: Florian Weimer <fweimer@redhat.com>
3 Date: Fri, 29 Apr 2016 10:35:34 +0200
4 Subject: [PATCH] CVE-2016-3706: getaddrinfo: stack overflow in hostent
5 conversion [BZ #20010]
7 When converting a struct hostent response to struct gaih_addrtuple, the
8 gethosts macro (which is called from gaih_inet) used alloca, without
9 malloc fallback for large responses. This commit changes this code to
10 use calloc unconditionally.
12 This commit also consolidated a second hostent-to-gaih_addrtuple
13 conversion loop (in gaih_inet) to use the new conversion function.
15 diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
16 index 1ef3f20..fed2d3b 100644
17 --- a/sysdeps/posix/getaddrinfo.c
18 +++ b/sysdeps/posix/getaddrinfo.c
19 @@ -168,9 +168,58 @@ gaih_inet_serv (const char *servicename, const struct gaih_typeproto *tp,
20 return 0;
21 }
23 +/* Convert struct hostent to a list of struct gaih_addrtuple objects.
24 + h_name is not copied, and the struct hostent object must not be
25 + deallocated prematurely. *RESULT must be NULL or a pointer to an
26 + object allocated using malloc, which is freed. */
27 +static bool
28 +convert_hostent_to_gaih_addrtuple (const struct addrinfo *req,
29 + int family,
30 + struct hostent *h,
31 + struct gaih_addrtuple **result)
32 +{
33 + free (*result);
34 + *result = NULL;
35 +
36 + /* Count the number of addresses in h->h_addr_list. */
37 + size_t count = 0;
38 + for (char **p = h->h_addr_list; *p != NULL; ++p)
39 + ++count;
40 +
41 + /* Report no data if no addresses are available, or if the incoming
42 + address size is larger than what we can store. */
43 + if (count == 0 || h->h_length > sizeof (((struct gaih_addrtuple) {}).addr))
44 + return true;
45 +
46 + struct gaih_addrtuple *array = calloc (count, sizeof (*array));
47 + if (array == NULL)
48 + return false;
49 +
50 + for (size_t i = 0; i < count; ++i)
51 + {
52 + if (family == AF_INET && req->ai_family == AF_INET6)
53 + {
54 + /* Perform address mapping. */
55 + array[i].family = AF_INET6;
56 + memcpy(array[i].addr + 3, h->h_addr_list[i], sizeof (uint32_t));
57 + array[i].addr[2] = htonl (0xffff);
58 + }
59 + else
60 + {
61 + array[i].family = family;
62 + memcpy (array[i].addr, h->h_addr_list[i], h->h_length);
63 + }
64 + array[i].next = array + i + 1;
65 + }
66 + array[0].name = h->h_name;
67 + array[count - 1].next = NULL;
68 +
69 + *result = array;
70 + return true;
71 +}
72 +
73 #define gethosts(_family, _type) \
74 { \
75 - int i; \
76 int herrno; \
77 struct hostent th; \
78 struct hostent *h; \
79 @@ -219,36 +268,23 @@ gaih_inet_serv (const char *servicename, const struct gaih_typeproto *tp,
80 } \
81 else if (h != NULL) \
82 { \
83 - for (i = 0; h->h_addr_list[i]; i++) \
84 + /* Make sure that addrmem can be freed. */ \
85 + if (!malloc_addrmem) \
86 + addrmem = NULL; \
87 + if (!convert_hostent_to_gaih_addrtuple (req, _family,h, &addrmem)) \
88 { \
89 - if (*pat == NULL) \
90 - { \
91 - *pat = __alloca (sizeof (struct gaih_addrtuple)); \
92 - (*pat)->scopeid = 0; \
93 - } \
94 - uint32_t *addr = (*pat)->addr; \
95 - (*pat)->next = NULL; \
96 - (*pat)->name = i == 0 ? strdupa (h->h_name) : NULL; \
97 - if (_family == AF_INET && req->ai_family == AF_INET6) \
98 - { \
99 - (*pat)->family = AF_INET6; \
100 - addr[3] = *(uint32_t *) h->h_addr_list[i]; \
101 - addr[2] = htonl (0xffff); \
102 - addr[1] = 0; \
103 - addr[0] = 0; \
104 - } \
105 - else \
106 - { \
107 - (*pat)->family = _family; \
108 - memcpy (addr, h->h_addr_list[i], sizeof(_type)); \
109 - } \
110 - pat = &((*pat)->next); \
111 + _res.options |= old_res_options & RES_USE_INET6; \
112 + result = -EAI_SYSTEM; \
113 + goto free_and_return; \
114 } \
115 + *pat = addrmem; \
116 + /* The conversion uses malloc unconditionally. */ \
117 + malloc_addrmem = true; \
118 \
119 if (localcanon != NULL && canon == NULL) \
120 canon = strdupa (localcanon); \
121 \
122 - if (_family == AF_INET6 && i > 0) \
123 + if (_family == AF_INET6 && *pat != NULL) \
124 got_ipv6 = true; \
125 } \
126 }
127 @@ -612,44 +648,16 @@ gaih_inet (const char *name, const struct gaih_service *service,
128 {
129 if (h != NULL)
130 {
131 - int i;
132 - /* We found data, count the number of addresses. */
133 - for (i = 0; h->h_addr_list[i]; ++i)
134 - ;
135 - if (i > 0 && *pat != NULL)
136 - --i;
137 -
138 - if (__libc_use_alloca (alloca_used
139 - + i * sizeof (struct gaih_addrtuple)))
140 - addrmem = alloca_account (i * sizeof (struct gaih_addrtuple),
141 - alloca_used);
142 - else
143 - {
144 - addrmem = malloc (i
145 - * sizeof (struct gaih_addrtuple));
146 - if (addrmem == NULL)
147 - {
148 - result = -EAI_MEMORY;
149 - goto free_and_return;
150 - }
151 - malloc_addrmem = true;
152 - }
153 -
154 - /* Now convert it into the list. */
155 - struct gaih_addrtuple *addrfree = addrmem;
156 - for (i = 0; h->h_addr_list[i]; ++i)
157 + /* We found data, convert it. */
158 + if (!convert_hostent_to_gaih_addrtuple
159 + (req, AF_INET, h, &addrmem))
160 {
161 - if (*pat == NULL)
162 - {
163 - *pat = addrfree++;
164 - (*pat)->scopeid = 0;
165 - }
166 - (*pat)->next = NULL;
167 - (*pat)->family = AF_INET;
168 - memcpy ((*pat)->addr, h->h_addr_list[i],
169 - h->h_length);
170 - pat = &((*pat)->next);
171 + result = -EAI_MEMORY;
172 + goto free_and_return;
173 }
174 + *pat = addrmem;
175 + /* The conversion uses malloc unconditionally. */
176 + malloc_addrmem = true;
177 }
178 }
179 else
180 --
181 2.9.3