[PATCH] Fix endless loop in nss_dns getnetbyname [BZ #17630]

[Siddhesh Poyarekar]

On Mon, Dec 15, 2014 at 05:44:34PM +0100, Florian Weimer wrote:
> The outer loop never advanced the alias pointer in case of a parse error.  I
> think this patch restores the original intent, but I'm not sure.
> 
> Tested on x86_64-redhat-linux-gnu.
> 
> I have requested CVE assignment on oss-security.
> 
> -- 
> Florian Weimer / Red Hat Product Security

> From ac3dc70d931d9eb427085e67514a6dbef7142902 Mon Sep 17 00:00:00 2001
> From: Florian Weimer <fweimer@redhat.com>
> Date: Mon, 15 Dec 2014 17:41:13 +0100
> Subject: [PATCH] Avoid infinite loop in nss_dns getnetbyname [BZ #17630]
> 
> 2014-12-15  Florian Weimer  <fweimer@redhat.com>
> 
> 	[BZ #17630]
> 	* resolv/nss_dns/dns-network.c (getanswer_r): Iterate over alias
> 	names.
> 

Looks good to me.

Siddhesh

> diff --git a/NEWS b/NEWS
> index a324c10..39f326e 100644
> --- a/NEWS
> +++ b/NEWS
> @@ -13,8 +13,8 @@ Version 2.21
>    15884, 16469, 16617, 16619, 16657, 16740, 16857, 17192, 17266, 17344,
>    17363, 17370, 17371, 17411, 17460, 17475, 17485, 17501, 17506, 17508,
>    17522, 17555, 17570, 17571, 17572, 17573, 17574, 17581, 17582, 17583,
> -  17584, 17585, 17589, 17594, 17601, 17608, 17616, 17625, 17633, 17634,
> -  17647, 17653, 17664, 17665, 17668, 17682.
> +  17584, 17585, 17589, 17594, 17601, 17608, 17616, 17625, 17630, 17633,
> +  17634, 17647, 17653, 17664, 17665, 17668, 17682.
>  
>  * CVE-2104-7817 The wordexp function could ignore the WRDE_NOCMD flag
>    under certain input conditions resulting in the execution of a shell for
> @@ -25,6 +25,9 @@ Version 2.21
>  * CVE-2012-3406 printf-style functions could run into a stack overflow when
>    processing format strings with a large number of format specifiers.
>  
> +* The nss_dns implementation of getnetbyname could run into an infinite loop
> +  if the DNS response contained a PTR record of an unexpected format.
> +
>  * The minimum GCC version that can be used to build this version of the GNU
>    C Library is GCC 4.6.  Older GCC versions, and non-GNU compilers, can
>    still be used to compile programs using the GNU C Library.
> diff --git a/resolv/nss_dns/dns-network.c b/resolv/nss_dns/dns-network.c
> index 0a77c8b..08cf0a6 100644
> --- a/resolv/nss_dns/dns-network.c
> +++ b/resolv/nss_dns/dns-network.c
> @@ -398,8 +398,8 @@ getanswer_r (const querybuf *answer, int anslen, struct netent *result,
>  
>  	case BYNAME:
>  	  {
> -	    char **ap = result->n_aliases++;
> -	    while (*ap != NULL)
> +	    char **ap;
> +	    for (ap = result->n_aliases; *ap != NULL; ++ap)
>  	      {
>  		/* Check each alias name for being of the forms:
>  		   4.3.2.1.in-addr.arpa		= net 1.2.3.4
> -- 
> 2.1.0
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 473 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20141216/793e1565/attachment.sig>