[PATCH v4] resolv: Add test for gethostbyname_r unaligned buffer [BZ #18287]

Florian Weimer fweimer@redhat.com
Tue Jun 23 07:58:12 GMT 2026


* Sergey Kolosov:

> Add a test for the buffer overflow in gethostbyname_r (Bug 18287), which
> occurs when alignment padding is not subtracted from the remaining buffer
> length.
>
> The test uses binary search to find the exact required buffer size
> for a mocked DNS response. It then tests all pointer misalignments
> (1-7 bytes) using a custom 0xAA guard region. This guarantees
> deterministic detection of out-of-bounds writes, avoiding false
> negatives caused by malloc chunk rounding.
> ---
> Changes in v4:
> - Removed trailing newline ('\n') from FAIL_EXIT1 macro calls.
> - Dropped the 'host_name' argument from query_host() in favor of the
>   global constant.
> - Added missing <stdbool.h> include.
> - Sorted #include directives.
> - Initialized the gethostbyname_r result pointer to NULL.

Version 4 looks good to me.  I'm going to push it for you.

Reviewed-by: Florian Weimer <fweimer@redhat.com>

Thanks,
Florian



More information about the Libc-alpha mailing list