[PATCH v2] resolv: Check hostname for validity (CVE-2026-4438)

[Florian Weimer]

* Andreas Schwab:

> diff --git a/resolv/nss_dns/dns-host.c b/resolv/nss_dns/dns-host.c
> index 893137027e..e4173653c4 100644
> --- a/resolv/nss_dns/dns-host.c
> +++ b/resolv/nss_dns/dns-host.c
> @@ -988,6 +988,7 @@ gaih_getanswer_slice (unsigned char *packet, size_t packetlen,
>  		  if (__ns_name_unpack (c.begin, c.end,
>  					compressed_alias_name,
>  					nbuf, sizeof (nbuf)) >= 0
> +		      && __res_binary_hnok (nbuf)
>  		      && __ns_name_ntop (nbuf, hname, sizeof (hname)) >= 0)
>  		    /* Space checking is performed by the callers.  */
>  		    ntup->name = alloc_buffer_copy_string (abuf, hname);

There's a check before that:

	  if (store_canon && __res_binary_hnok (name_buffer))
	    /* This name can be used as a canonical name.  Do not
	       translate to text form here to conserve buffer space.
	       Point to the compressed name because name_buffer can be
	       overwritten with an unusable name later.  */
	    compressed_alias_name = rr.rdata;

As far as I can see, compressed_alias_name is only ever set if it's a
host name.  And the name expanded into nbuf comes from
compressed_alias_name.  I can't see a verification gap.

Thanks,
Florian