summary refs log tree commit diff
path: root/resolv/res_query.c
diff options
context:
space:
mode:
authorFlorian Weimer <fweimer@redhat.com>2016-12-31 20:22:09 +0100
committerFlorian Weimer <fweimer@redhat.com>2016-12-31 20:27:44 +0100
commitfc82b0a2dfe7dbd35671c10510a8da1043d746a5 (patch)
tree86b8ef6421ca34fa1907121e078e008c580029ea /resolv/res_query.c
parent3c589b1a8a4401e258ba23a03fcbcc79b82393ab (diff)
downloadglibc-fc82b0a2dfe7dbd35671c10510a8da1043d746a5.tar.gz
glibc-fc82b0a2dfe7dbd35671c10510a8da1043d746a5.tar.xz
glibc-fc82b0a2dfe7dbd35671c10510a8da1043d746a5.zip
CVE-2015-5180: resolv: Fix crash with internal QTYPE [BZ #18784]
Also rename T_UNSPEC because an upcoming public header file
update will use that name.
Diffstat (limited to 'resolv/res_query.c')
-rw-r--r--resolv/res_query.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/resolv/res_query.c b/resolv/res_query.c
index 944d1a90f5..07dc6f6583 100644
--- a/resolv/res_query.c
+++ b/resolv/res_query.c
@@ -122,7 +122,7 @@ __libc_res_nquery(res_state statp,
 	int n, use_malloc = 0;
 	u_int oflags = statp->_flags;
 
-	size_t bufsize = (type == T_UNSPEC ? 2 : 1) * QUERYSIZE;
+	size_t bufsize = (type == T_QUERY_A_AND_AAAA ? 2 : 1) * QUERYSIZE;
 	u_char *buf = alloca (bufsize);
 	u_char *query1 = buf;
 	int nquery1 = -1;
@@ -137,7 +137,7 @@ __libc_res_nquery(res_state statp,
 		printf(";; res_query(%s, %d, %d)\n", name, class, type);
 #endif
 
-	if (type == T_UNSPEC)
+	if (type == T_QUERY_A_AND_AAAA)
 	  {
 	    n = res_nmkquery(statp, QUERY, name, class, T_A, NULL, 0, NULL,
 			     query1, bufsize);
@@ -190,7 +190,7 @@ __libc_res_nquery(res_state statp,
 	if (__builtin_expect (n <= 0, 0) && !use_malloc) {
 		/* Retry just in case res_nmkquery failed because of too
 		   short buffer.  Shouldn't happen.  */
-		bufsize = (type == T_UNSPEC ? 2 : 1) * MAXPACKET;
+		bufsize = (type == T_QUERY_A_AND_AAAA ? 2 : 1) * MAXPACKET;
 		buf = malloc (bufsize);
 		if (buf != NULL) {
 			query1 = buf;