forked from pool/glibc
Andreas Schwab
44414488d6
- Import patches from 2.23 branch OBS-URL: https://build.opensuse.org/request/show/394998 OBS-URL: https://build.opensuse.org/package/show/Base:System/glibc?expand=0&rev=436
61 lines
2.1 KiB
Diff
61 lines
2.1 KiB
Diff
2016-04-01 Florian Weimer <fweimer@redhat.com>
|
||
|
||
[BZ #19879]
|
||
CVE-2016-3075
|
||
* resolv/nss_dns/dns-network.c (_nss_dns_getnetbyname_r): Do not
|
||
copy name.
|
||
|
||
Index: glibc-2.23/NEWS
|
||
===================================================================
|
||
--- glibc-2.23.orig/NEWS
|
||
+++ glibc-2.23/NEWS
|
||
@@ -9,7 +9,10 @@ Version 2.23.1
|
||
|
||
Security related changes:
|
||
|
||
- [Add security related changes here]
|
||
+* The getnetbyname implementation in nss_dns had a potentially unbounded
|
||
+ alloca call (in the form of a call to strdupa), leading to a stack
|
||
+ overflow (stack exhaustion) and a crash if getnetbyname is invoked
|
||
+ on a very long name. (CVE-2016-3075)
|
||
|
||
The following bugs are resolved with this release:
|
||
|
||
@@ -17,9 +20,12 @@ The following bugs are resolved with thi
|
||
[19758] Or bit_Prefer_MAP_32BIT_EXEC in EXTRA_LD_ENVVARS
|
||
[19759] Don't inline mempcpy for x86
|
||
[19762] Use HAS_ARCH_FEATURE with Fast_Rep_String
|
||
- [19791] Assertion failure in res_query.c with un-connectable name server addresses
|
||
+ [19791] Assertion failure in res_query.c with un-connectable name server
|
||
+ addresses
|
||
[19792] MIPS: backtrace yields infinite backtrace with makecontext
|
||
[19822] libm.so install clobbers old version
|
||
+ [19879] network: nss_dns: Stack overflow in getnetbyname implementation
|
||
+ (CVE-2016-3075)
|
||
|
||
|
||
Version 2.23
|
||
Index: glibc-2.23/resolv/nss_dns/dns-network.c
|
||
===================================================================
|
||
--- glibc-2.23.orig/resolv/nss_dns/dns-network.c
|
||
+++ glibc-2.23/resolv/nss_dns/dns-network.c
|
||
@@ -118,17 +118,14 @@ _nss_dns_getnetbyname_r (const char *nam
|
||
} net_buffer;
|
||
querybuf *orig_net_buffer;
|
||
int anslen;
|
||
- char *qbuf;
|
||
enum nss_status status;
|
||
|
||
if (__res_maybe_init (&_res, 0) == -1)
|
||
return NSS_STATUS_UNAVAIL;
|
||
|
||
- qbuf = strdupa (name);
|
||
-
|
||
net_buffer.buf = orig_net_buffer = (querybuf *) alloca (1024);
|
||
|
||
- anslen = __libc_res_nsearch (&_res, qbuf, C_IN, T_PTR, net_buffer.buf->buf,
|
||
+ anslen = __libc_res_nsearch (&_res, name, C_IN, T_PTR, net_buffer.buf->buf,
|
||
1024, &net_buffer.ptr, NULL, NULL, NULL, NULL);
|
||
if (anslen < 0)
|
||
{
|