[PATCH v2] resolv: Check hostname for validity (CVE-2026-4438)

[Andreas Schwab]

diff --git a/resolv/nss_dns/dns-host.c b/resolv/nss_dns/dns-host.c
index 893137027e..e4173653c4 100644
--- a/resolv/nss_dns/dns-host.c
+++ b/resolv/nss_dns/dns-host.c
@@ -988,6 +988,7 @@ gaih_getanswer_slice (unsigned char *packet, size_t packetlen,
 		  if (__ns_name_unpack (c.begin, c.end,
 					compressed_alias_name,
 					nbuf, sizeof (nbuf)) >= 0
+		      && __res_binary_hnok (nbuf)
 		      && __ns_name_ntop (nbuf, hname, sizeof (hname)) >= 0)
 		    /* Space checking is performed by the callers.  */
 		    ntup->name = alloc_buffer_copy_string (abuf, hname);

-- 
Andreas Schwab, SUSE Labs, schwab@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE  1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."