[PATCH v4] resolv: Add test for gethostbyname_r unaligned buffer [BZ #18287]
Florian Weimer
fweimer@redhat.com
Tue Jun 23 07:58:12 GMT 2026
* Sergey Kolosov:
> Add a test for the buffer overflow in gethostbyname_r (Bug 18287), which
> occurs when alignment padding is not subtracted from the remaining buffer
> length.
>
> The test uses binary search to find the exact required buffer size
> for a mocked DNS response. It then tests all pointer misalignments
> (1-7 bytes) using a custom 0xAA guard region. This guarantees
> deterministic detection of out-of-bounds writes, avoiding false
> negatives caused by malloc chunk rounding.
> ---
> Changes in v4:
> - Removed trailing newline ('\n') from FAIL_EXIT1 macro calls.
> - Dropped the 'host_name' argument from query_host() in favor of the
> global constant.
> - Added missing <stdbool.h> include.
> - Sorted #include directives.
> - Initialized the gethostbyname_r result pointer to NULL.
Version 4 looks good to me. I'm going to push it for you.
Reviewed-by: Florian Weimer <fweimer@redhat.com>
Thanks,
Florian
More information about the Libc-alpha
mailing list