AuroraMiddleware/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2025-01-09 10:50:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix memory leak in _nss_dns_gethostbyname4_r with big DNS answer

Browse Source
This commit is contained in:
Andreas Schwab 2014-02-13 11:01:57 +01:00
parent 743151aeae
commit d668061994
3 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ChangeLog
View File

@ -1,3 +1,9 @@
2014-02-13 Andreas Schwab <schwab@suse.de>
[BZ #16574]
* resolv/nss_dns/dns-host.c (_nss_dns_gethostbyname4_r): Free the
second answer buffer if it was separately allocated.
2014-02-12 Joseph Myers <joseph@codesourcery.com> 2014-02-12 Joseph Myers <joseph@codesourcery.com>
* sysdeps/mips/math-tests.h: Include <features.h>. * sysdeps/mips/math-tests.h: Include <features.h>.

2
NEWS
View File

@ -9,7 +9,7 @@ Version 2.20
* The following bugs are resolved with this release: * The following bugs are resolved with this release:
15894, 16447, 16545. 15894, 16447, 16545, 16574.
* The am33 port, which had not worked for several years, has been removed * The am33 port, which had not worked for several years, has been removed
from ports. from ports.

12
resolv/nss_dns/dns-host.c
View File

@ -298,13 +298,14 @@ _nss_dns_gethostbyname4_r (const char *name, struct gaih_addrtuple **pat,
name = cp; name = cp;
} }
int anslen = 2048;
union union
{ {
querybuf *buf; querybuf *buf;
u_char *ptr; u_char *ptr;
} host_buffer; } host_buffer;
querybuf *orig_host_buffer; querybuf *orig_host_buffer;
host_buffer.buf = orig_host_buffer = (querybuf *) alloca (2048); host_buffer.buf = orig_host_buffer = (querybuf *) alloca (anslen);
u_char *ans2p = NULL; u_char *ans2p = NULL;
int nans2p = 0; int nans2p = 0;
int resplen2 = 0; int resplen2 = 0;
@ -312,7 +313,7 @@ _nss_dns_gethostbyname4_r (const char *name, struct gaih_addrtuple **pat,
int olderr = errno; int olderr = errno;
enum nss_status status; enum nss_status status;
int n = __libc_res_nsearch (&_res, name, C_IN, T_UNSPEC, int n = __libc_res_nsearch (&_res, name, C_IN, T_UNSPEC,
host_buffer.buf->buf, 2048, &host_buffer.ptr, host_buffer.buf->buf, anslen, &host_buffer.ptr,
&ans2p, &nans2p, &resplen2); &ans2p, &nans2p, &resplen2);
if (n < 0) if (n < 0)
{ {
@ -352,6 +353,13 @@ _nss_dns_gethostbyname4_r (const char *name, struct gaih_addrtuple **pat,
resplen2, name, pat, buffer, buflen, resplen2, name, pat, buffer, buflen,
errnop, herrnop, ttlp); errnop, herrnop, ttlp);
/* Check whether ans2p was separately allocated. */
if (host_buffer.buf != orig_host_buffer)
anslen = MAXPACKET;
if (ans2p != NULL
&& (ans2p < host_buffer.ptr || ans2p >= host_buffer.ptr + anslen))
free (ans2p);
if (host_buffer.buf != orig_host_buffer) if (host_buffer.buf != orig_host_buffer)
free (host_buffer.buf); free (host_buffer.buf);