diff options
| author | Florian Weimer <fweimer@redhat.com> | 2023-09-13 14:10:56 +0200 |
|---|---|---|
| committer | Florian Weimer <fweimer@redhat.com> | 2023-09-13 14:10:56 +0200 |
| commit | bd77dd7e73e3530203be1c52c8a29d08270cb25d (patch) | |
| tree | b5d84f536d6c48f6ca85b61b42231fe01fc4384a /resolv/nss_dns | |
| parent | c8fa383f4cec9cf1c0cc8ec97903c09af10286f4 (diff) | |
| download | glibc-bd77dd7e73e3530203be1c52c8a29d08270cb25d.tar.gz glibc-bd77dd7e73e3530203be1c52c8a29d08270cb25d.tar.xz glibc-bd77dd7e73e3530203be1c52c8a29d08270cb25d.zip | |
CVE-2023-4527: Stack read overflow with large TCP responses in no-aaaa mode
Without passing alt_dns_packet_buffer, __res_context_search can only
store 2048 bytes (what fits into dns_packet_buffer). However,
the function returns the total packet size, and the subsequent
DNS parsing code in _nss_dns_gethostbyname4_r reads beyond the end
of the stack-allocated buffer.
Fixes commit f282cdbe7f436c75864e5640a4 ("resolv: Implement no-aaaa
stub resolver option") and bug 30842.
Diffstat (limited to 'resolv/nss_dns')
| -rw-r--r-- | resolv/nss_dns/dns-host.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/resolv/nss_dns/dns-host.c b/resolv/nss_dns/dns-host.c index c8b77bbc35..119dc9f00f 100644 --- a/resolv/nss_dns/dns-host.c +++ b/resolv/nss_dns/dns-host.c @@ -427,7 +427,7 @@ _nss_dns_gethostbyname4_r (const char *name, struct gaih_addrtuple **pat, { n = __res_context_search (ctx, name, C_IN, T_A, dns_packet_buffer, sizeof (dns_packet_buffer), - NULL, NULL, NULL, NULL, NULL); + &alt_dns_packet_buffer, NULL, NULL, NULL, NULL); if (n >= 0) status = gaih_getanswer_noaaaa (alt_dns_packet_buffer, n, &abuf, pat, errnop, herrnop, ttlp); |