[PATCH v2] resolv: Check hostname for validity (CVE-2026-4438)

[Carlos O'Donell]

On 3/26/26 9:20 AM, Andreas Schwab wrote:
> On Mär 26 2026, Carlos O'Donell wrote:
> 
>> The processed hostname in getanswer_ptr should be correctly checked to
>> avoid invalid characters from being allowed, including shell
>> metacharacters. It is a security issue to fail to check the returned
>> hostname for validity.
> 
> Should gaih_getanswer_slice have that check as well?
> 

May you please provide a patch that shows where you think the check would go?

If you can write a test case using the callback based resolver test framework
that would be even better.

Are you looking at places where we call __ns_name_unpack() and reviewing if
the results need similar checking?

-- 
Cheers,
Carlos.