[RFC] resolv: Align buf before second query for A_AAA in __res_context_query

Ludwig Rydberg ludwig.rydberg@gaisler.com
Thu Dec 7 12:47:18 GMT 2023


Hi Florian,

I took some time to investigate the issue.

As I understand it, the __res_context_query might need to create two 
queries in case the type is T_QUERY_A_AND_AAAA.
In this case, a single buffer with enough room to hold two queries is used.

The first query fills up n bytes of the buffer and the second query is 
added just after:
buf: |<---query1-->|<---query2--->|

Then since the length of query1 varies, query2 might start on an 
unaligned address.
And that leads to SIGBUS on sparc32+linux in __res_context_mkquery when 
the unaligned query2-buf is casted to a HEADER and accessed.

Initially I had a look at __res_context_mkquery (as you suggested) but 
couldn't really see how this could be handled there efficiently.
There are also other functions (__res_nopt, __res_handle_no_aaaa, 
__res_context_send, ...) that use the query later on which would then 
led to the same crash.

It could be solved by using two separate buffers for the queries but I 
don't think that is the right way.
I understand that the api does not require aligned buffers but since 
this is part of an optimization (same buffer for both queries) perhaps 
it could be fine?

Any thoughts or ideas on how to proceed?

Best regards,
// Ludwig

On 2023-11-30 16:11, Ludwig Rydberg wrote:
> On 2023-11-30 14:14, Florian Weimer wrote:
>>
>> I was a bit vague because you didn't say were it crashed.  If it's
>> res_mkquery, I suggest to fix it there.
> 
> True, I could have given some more details. It crash in 
> res_mkquery:__res_context_mkquery for the second query when using the 
> unaligned buffer (from the first query).
> 
> Thanks, I will take a look.
> 
> Best regards,
> // Ludwig


More information about the Libc-alpha mailing list