This is the mail archive of the
libc-alpha@sourceware.org
mailing list for the glibc project.
[PATCH] resolv: Always initialize *resplen2 out parameter [BZ #19791]
- From: Florian Weimer <fweimer at redhat dot com>
- To: GNU C Library <libc-alpha at sourceware dot org>
- Date: Fri, 11 Mar 2016 16:00:43 +0100
- Subject: [PATCH] resolv: Always initialize *resplen2 out parameter [BZ #19791]
- Authentication-results: sourceware.org; auth=none
Since commit 44d20bca52ace85850012b0ead37b360e3ecd96e (Implement
second fallback mode for DNS requests), there is a code path
which returns early, before *resplen2 is initialized. This
happens if the name server address is immediately recognized
as invalid (because of lack of protocol support, or if it is
a broadcast address such 255.255.255.255, or another invalid
address).
If this happens and *resplen2 was non-zero (which is the case
if a previous query resulted in a failure), __libc_res_nquery
would reuse an existing second answer buffer. This answer
has been previously identified as unusable (for example,
it could be an NXDOMAIN response). Due to the presence of
a second answer, no name server switching will occur. The
result is a name resolution failure, although a successful
resolution would have been possible if name servers have
been switched and queries had proceeded along the search path.
The above paragraph still simplifies the situation. Before
glibc 2.23, if the second answer needed malloc, the stub
resolver would still attempt to reuse the second answer,
but this is not possible because __libc_res_nsearch has freed
it, after the unsuccessful call to __libc_res_nquerydomain,
and set the buffer pointer to NULL. This eventually leads to
an assertion failure in __libc_res_nquery:
/* Make sure both hp and hp2 are defined */
assert((hp != NULL) && (hp2 != NULL));
If assertions are disabled, the consequence is a NULL pointer
dereference on the next line.
Starting with glibc 2.23, as a result of commit
e9db92d3acfe1822d56d11abcea5bfc4c41cf6ca (CVE-2015-7547:
getaddrinfo() stack-based buffer overflow (Bug 18665)),
the second answer is always allocated with malloc. This means
that the assertion failure happens with small responses as well
because there is no buffer to reuse, as soon as there is a
name resolution failure which triggers a search for an answer
along the search path.
I've also attached a revised test case (for the existing out-of-tree
test framework).
Florian
2016-03-11 Florian Weimer <fweimer@redhat.com>
[BZ #19791]
* resolv/res_send.c (send_dg): Initialize *resplen2 early.
diff --git a/resolv/res_send.c b/resolv/res_send.c
index 25c19f1..5598ca6 100644
--- a/resolv/res_send.c
+++ b/resolv/res_send.c
@@ -1112,6 +1112,8 @@ send_dg(res_state statp,
int retval;
retry_reopen:
+ if (resplen2 != NULL)
+ *resplen2 = 0;
retval = reopen (statp, terrno, ns);
if (retval <= 0)
return retval;
@@ -1127,8 +1129,6 @@ send_dg(res_state statp,
int recvresp2 = buf2 == NULL;
pfd[0].fd = EXT(statp).nssocks[ns];
pfd[0].events = POLLOUT;
- if (resplen2 != NULL)
- *resplen2 = 0;
wait:
if (need_recompute) {
recompute_resend:
/* Test for incorrect reuse of second buffer in AF_UNSPEC processing.
Copyright (C) 2016 Free Software Foundation, Inc.
This file is part of the GNU C Library.
The GNU C Library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
The GNU C Library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with the GNU C Library; if not, see
<http://www.gnu.org/licenses/>. */
#include "tst-resolv-aux.h"
#include <resolv.h>
#include <string.h>
#include <stdlib.h>
struct entry
{
const char *name;
int response;
};
const struct entry entries[] =
{
{"www.example.com", 1},
{}
};
enum
{
name_not_found = -1,
name_no_data = -2
};
static int
find_name (const char *name)
{
for (int i = 0; entries[i].name != NULL; ++i)
{
if (strcmp (name, entries[i].name) == 0)
return i;
}
if (strcmp (name, "example.com") == 0
|| strcmp (name, "usersys.example.com") == 0
|| strcmp (name, "corp.example.com") == 0)
return name_no_data;
return name_not_found;
}
static const char address_ipv4[4] = {192, 0, 2, 1};
static const char address_ipv6[16]
= {0x20, 0x01, 0xd, 0xb8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1};
static int rcode_override_server_index = -1;
static int rcode_override;
static void
response (const struct response_context *ctx,
struct response_builder *b,
const char *qname, uint16_t qclass, uint16_t qtype)
{
if (ctx->server_index == rcode_override_server_index)
{
struct response_flags flags = {.rcode = rcode_override};
response_init (b, flags);
response_add_question (b, qname, qclass, qtype);
return;
}
int index = find_name (qname);
struct response_flags flags = {};
if (index == name_not_found)
flags.rcode = ns_r_nxdomain;
else if (index >= 0 && entries[index].response < 0)
flags.rcode = -entries[index].response;
else if (index >= 0 && entries[index].response > 5 && !ctx->tcp)
/* Force TCP if more than 5 addresses where requested. */
flags.tc = true;
response_init (b, flags);
response_add_question (b, qname, qclass, qtype);
if (flags.tc || index < 0 || entries[index].response < 0)
{
char buf[4096];
memset(buf, 0, sizeof(buf));
response_add_data (b, buf, sizeof(buf));
return;
}
response_section (b, section_answer);
for (int i = 0; i < entries[index].response; ++i)
{
response_open_record (b, qname, qclass, qtype, 0);
switch (qtype)
{
case T_A:
{
char addr[4] = {10, index, i >> 8, i};
response_add_data (b, addr, sizeof (addr));
}
break;
case T_AAAA:
{
char addr[16]
= {0x20, 0x01, 0xd, 0xb8, 0, 0, 0, 0, 0, 0, 0, 0,
0, index + 1, (i + 1) >> 8, i + 1};
response_add_data (b, addr, sizeof (addr));
}
break;
default:
printf ("error: unexpected QTYPE: %s/%u/%u\n",
qname, qclass, qtype);
abort ();
}
response_close_record (b);
}
}
enum output_format
{
format_get, format_gai
};
static void
format_expected_1 (FILE *out, int family, enum output_format format, int index)
{
for (int i = 0; i < entries[index].response; ++i)
{
char address[200];
switch (family)
{
case AF_INET:
snprintf (address, sizeof (address), "10.%d.%d.%d",
index, (i >> 8) & 0xff, i & 0xff);
break;
case AF_INET6:
snprintf (address, sizeof (address), "2001:db8::%x:%x",
index + 1, i + 1);
break;
default:
abort ();
}
switch (format)
{
case format_get:
fprintf (out, "address: %s\n", address);
break;
case format_gai:
fprintf (out, "address: STREAM/TCP %s 80\n", address);
}
}
}
static char *
format_expected (const char *fqdn, int family, enum output_format format)
{
int index = find_name (fqdn);
if (index < 0)
{
printf ("error: FQDN lookup failure (test bug): %s\n", fqdn);
abort ();
}
struct resolv_memstream stream;
resolv_xopen_memstream (&stream);
if (entries[index].response < 0)
abort ();
if (format == format_get)
fprintf (stream.out, "name: %s\n", entries[index].name);
if (family == AF_INET || family == AF_UNSPEC)
format_expected_1 (stream.out, AF_INET, format, index);
if (family == AF_INET6 || family == AF_UNSPEC)
format_expected_1 (stream.out, AF_INET6, format, index);
resolv_xfclose_memstream (&stream);
return stream.buffer;
}
static void
do_get (const char *name, const char *fqdn, int family)
{
char *expected = format_expected (fqdn, family, format_get);
if (family == AF_INET)
check_hostent (gethostbyname (name), expected);
check_hostent (gethostbyname2 (name, family), expected);
/* Test res_search. */
int qtype;
switch (family)
{
case AF_INET:
qtype = T_A;
break;
case AF_INET6:
qtype = T_AAAA;
break;
default:
qtype = -1;
}
if (qtype >= 0)
{
int sz = 512;
unsigned char *response = malloc (sz);
if (response == NULL)
{
printf ("error: malloc: %m\n");
abort ();
}
int ret = res_search (name, C_IN, qtype, response, sz);
if (ret < 0)
{
printf ("error: res_search (\"%s\")\n", name);
abort ();
}
if (ret > sz)
{
/* Truncation. Retry with a larger buffer. */
sz = 65535;
unsigned char *newptr = realloc (response, sz);
if (newptr == NULL)
{
printf ("error: realloc: %m\n");
abort ();
}
response = newptr;
ret = res_search (name, C_IN, qtype, response, sz);
if (ret < 0)
{
printf ("error: res_search (\"%s\")\n", name);
abort ();
}
if (ret > sz)
{
printf ("error: res_search (\"%s\"): invalid return value %d\n",
name, ret);
abort ();
}
}
check_packet (response, ret, expected);
free (response);
}
free (expected);
}
static void
do_gai (const char *name, const char *fqdn, int family)
{
struct addrinfo hints =
{
.ai_family = family,
.ai_protocol = IPPROTO_TCP,
.ai_socktype = SOCK_STREAM
};
struct addrinfo *ai;
int ret = getaddrinfo (name, "80", &hints, &ai);
char *expected = format_expected (fqdn, family, format_gai);
check_addrinfo (ai, ret, expected);
if (ret == 0)
freeaddrinfo (ai);
free (expected);
}
int
main (void)
{
struct redirect_config config =
{
.response_callback = response,
.search = {"usersys.example.com", "corp.example.com", "example.com"},
};
struct resolv_aux *aux = resolv_redirect (config);
/* 255.255.255.255 results in an immediate connect failure. */
_res.nsaddr_list[0].sin_addr.s_addr = -1;
_res.nsaddr_list[0].sin_port = htons(53);
do_gai ("www", "www.example.com", AF_UNSPEC);
resolv_redirect_finish (aux);
}