diff options
| author | Florian Weimer <fweimer@redhat.com> | 2023-09-13 14:10:56 +0200 |
|---|---|---|
| committer | Florian Weimer <fweimer@redhat.com> | 2023-09-13 14:37:57 +0200 |
| commit | 4ea972b7edd7e36610e8cde18bf7a8149d7bac4f (patch) | |
| tree | 201fcf59f1ca9923fb3597b97d60caaa7453c1b2 /resolv/Makefile | |
| parent | f441cb9a70fa3f55e9bbd615924879d692d21a6c (diff) | |
| download | glibc-4ea972b7edd7e36610e8cde18bf7a8149d7bac4f.tar.gz glibc-4ea972b7edd7e36610e8cde18bf7a8149d7bac4f.tar.xz glibc-4ea972b7edd7e36610e8cde18bf7a8149d7bac4f.zip | |
CVE-2023-4527: Stack read overflow with large TCP responses in no-aaaa mode
Without passing alt_dns_packet_buffer, __res_context_search can only
store 2048 bytes (what fits into dns_packet_buffer). However,
the function returns the total packet size, and the subsequent
DNS parsing code in _nss_dns_gethostbyname4_r reads beyond the end
of the stack-allocated buffer.
Fixes commit f282cdbe7f436c75864e5640a4 ("resolv: Implement no-aaaa
stub resolver option") and bug 30842.
(cherry picked from commit bd77dd7e73e3530203be1c52c8a29d08270cb25d)
Diffstat (limited to 'resolv/Makefile')
| -rw-r--r-- | resolv/Makefile | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/resolv/Makefile b/resolv/Makefile index f8a92c6cff..28cedf49ee 100644 --- a/resolv/Makefile +++ b/resolv/Makefile @@ -101,6 +101,7 @@ tests += \ tst-resolv-invalid-cname \ tst-resolv-network \ tst-resolv-noaaaa \ + tst-resolv-noaaaa-vc \ tst-resolv-nondecimal \ tst-resolv-res_init-multi \ tst-resolv-search \ @@ -291,6 +292,7 @@ $(objpfx)tst-resolv-res_init-thread: $(objpfx)libresolv.so \ $(objpfx)tst-resolv-invalid-cname: $(objpfx)libresolv.so \ $(shared-thread-library) $(objpfx)tst-resolv-noaaaa: $(objpfx)libresolv.so $(shared-thread-library) +$(objpfx)tst-resolv-noaaaa-vc: $(objpfx)libresolv.so $(shared-thread-library) $(objpfx)tst-resolv-nondecimal: $(objpfx)libresolv.so $(shared-thread-library) $(objpfx)tst-resolv-qtypes: $(objpfx)libresolv.so $(shared-thread-library) $(objpfx)tst-resolv-rotate: $(objpfx)libresolv.so $(shared-thread-library) |