[PATCH] CVE-2016-3706: getaddrinfo: stack overflow in hostent conversion [BZ #20010]

[Florian Weimer]

On 04/27/2016 02:13 PM, Florian Weimer wrote:
> When converting a struct hostent response to struct gaih_addrtuple, the
> gethosts macro (which is called from gaih_inet) used alloca, without
> malloc fallback for large responses.  This commit changes this code to
> use calloc unconditionally.
>
> This commit also consolidated a second hostent-to-gaih_addrtuple
> conversion loop (in gaih_inet) to use the new conversion function.
>
> Tested with the external resolver tests.  Valgrind shows no (new) memory
> leaks.

I have committed this, with the following NEWS entry:

* Previously, getaddrinfo copied large amounts of address data to the stack,
   even after the fix for CVE-2013-4458 has been applied, potentially
   resulting in a stack overflow.  getaddrinfo now uses a heap allocation
   instead.  Reported by Michael Petlan.  (CVE-2016-3706)

Florian