diff options
| author | Florian Weimer <fweimer@redhat.com> | 2014-12-15 17:41:13 +0100 |
|---|---|---|
| committer | Allan McRae <allan@archlinux.org> | 2014-12-18 11:06:19 +1000 |
| commit | f80af76648ed97a76745fad6caa3315a79cb1c7c (patch) | |
| tree | e5c8cc05d943581a0c10bbe7c2333b3572370e69 | |
| parent | a3a1f4163c4d0f9a36056c8640661a88674ae8a2 (diff) | |
| download | glibc-f80af76648ed97a76745fad6caa3315a79cb1c7c.tar.gz glibc-f80af76648ed97a76745fad6caa3315a79cb1c7c.tar.xz glibc-f80af76648ed97a76745fad6caa3315a79cb1c7c.zip | |
Avoid infinite loop in nss_dns getnetbyname [BZ #17630]
(cherry picked from commit 11e3417af6e354f1942c68a271ae51e892b2814d) (cherry picked from commit e54db0ea6a49affac43fa305fd134f3020c41382) Conflicts: NEWS
| -rw-r--r-- | ChangeLog | 6 | ||||
| -rw-r--r-- | NEWS | 8 | ||||
| -rw-r--r-- | resolv/nss_dns/dns-network.c | 4 |
3 files changed, 14 insertions, 4 deletions
diff --git a/ChangeLog b/ChangeLog index 88d2f1edde..e416cd0e62 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2014-12-16 Florian Weimer <fweimer@redhat.com> + + [BZ #17630] + * resolv/nss_dns/dns-network.c (getanswer_r): Iterate over alias + names. + 2014-12-15 Jeff Law <law@redhat.com> [BZ #16617] diff --git a/NEWS b/NEWS index f6cdb66142..9bc835c4d1 100644 --- a/NEWS +++ b/NEWS @@ -9,7 +9,7 @@ Version 2.20.1 * The following bugs are resolved with this release: - 16617, 17266, 17370, 17371, 17460, 17485, 17555, 17625. + 16617, 17266, 17370, 17371, 17460, 17485, 17555, 17625, 17630. * CVE-2104-7817 The wordexp function could ignore the WRDE_NOCMD flag under certain input conditions resulting in the execution of a shell for @@ -18,7 +18,11 @@ Version 2.20.1 shell and returns the error WRDE_CMDSUB as expected. * CVE-2012-3406 printf-style functions could run into a stack overflow when - processing format strings with a large number of format specifiers.a + processing format strings with a large number of format specifiers. + +* CVE-2014-9402 The nss_dns implementation of getnetbyname could run into an + infinite loopif the DNS response contained a PTR record of an unexpected + format. Version 2.20 diff --git a/resolv/nss_dns/dns-network.c b/resolv/nss_dns/dns-network.c index 0a77c8bc48..08cf0a6462 100644 --- a/resolv/nss_dns/dns-network.c +++ b/resolv/nss_dns/dns-network.c @@ -398,8 +398,8 @@ getanswer_r (const querybuf *answer, int anslen, struct netent *result, case BYNAME: { - char **ap = result->n_aliases++; - while (*ap != NULL) + char **ap; + for (ap = result->n_aliases; *ap != NULL; ++ap) { /* Check each alias name for being of the forms: 4.3.2.1.in-addr.arpa = net 1.2.3.4 |