[PATCH] CVE-2016-3706: getaddrinfo: stack overflow in hostent conversion [BZ #20010]

[Florian Weimer]

When converting a struct hostent response to struct gaih_addrtuple, the
gethosts macro (which is called from gaih_inet) used alloca, without
malloc fallback for large responses.  This commit changes this code to
use calloc unconditionally.

This commit also consolidated a second hostent-to-gaih_addrtuple
conversion loop (in gaih_inet) to use the new conversion function.

Tested with the external resolver tests.  Valgrind shows no (new) memory 
leaks.

In a future rewrite, we should try to avoid the temporary conversion to 
a struct gaih_addrtuple list.  The code needs to create a struct 
addrinfo list, and the intermediate conversion is not strictly necessary.

Florian
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-CVE-2016-3706-getaddrinfo-stack-overflow-in-hostent-.patch
Type: text/x-patch
Size: 5698 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20160427/964580eb/attachment.bin>