public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug libc/10484] New: getaddrinfo segfaults if /etc/hosts has a long line
@ 2009-08-05 15:22 lars at ubuntu dot com
  2009-08-05 19:29 ` [Bug libc/10484] " fibonacci dot prower at gmail dot com
                   ` (3 more replies)
  0 siblings, 4 replies; 10+ messages in thread
From: lars at ubuntu dot com @ 2009-08-05 15:22 UTC (permalink / raw)
  To: glibc-bugs

If /etc/hosts contains a long line (thousands of bytes), getaddrinfo causes a
segmentation fault. A small program to test:

-- 8< ---
#include <stddef.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>

int main(void)
{
    struct addrinfo *result;
    getaddrinfo("localhost", NULL, NULL, &result);
    return 0;
}
--- 8< ---

On a system with short lines in /etc/hosts, the above program exits normally. If
/etc/hosts has a very long line (5500 bytes is sufficiently long), it
segmentation faults.

I think this is due to using alloca and extend_alloca to hold the line when
parsing the file, which leads to a stack overflow, which then results in the
kernel sending a SIGSEGV to the program. The parsing code is not set up to
handle that. Unfortunately, I am too stupid to provide a patch to fix this.

My test /etc/hosts file has IPv6 addresses commented out, so the segmentation
fault happens in sysdeps/posix/getaddrinfo.c, function gaih_inet, around line
531, on this line:

                  rc = __gethostbyname2_r (name, family, &th, tmpbuf,
                                           tmpbuflen, &h, &herrno);

My stack limit is 8 megabytes.

This was originally filed as a bug in Ubuntu, and applies to both versions 2.9
and 2.10 in that distribution. I have compared the source file against the
current version in git, and it has no relevant changes. (I was unable to set up
a chroot to actually test the current git version, sorry.)

Original bug: https://bugs.launchpad.net/ubuntu/+source/eglibc/+bug/386791

-- 
           Summary: getaddrinfo segfaults if /etc/hosts has a long line
           Product: glibc
           Version: 2.9
            Status: NEW
          Severity: minor
          Priority: P2
         Component: libc
        AssignedTo: drepper at redhat dot com
        ReportedBy: lars at ubuntu dot com
                CC: glibc-bugs at sources dot redhat dot com
 GCC build triplet: x86_64-unknown-linux-gnu
  GCC host triplet: x86_64-unknown-linux-gnu
GCC target triplet: x86_64-unknown-linux-gnu


http://sourceware.org/bugzilla/show_bug.cgi?id=10484

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.


^ permalink raw reply	[flat|nested] 10+ messages in thread
end of thread, other threads:[~2014-07-01  7:26 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <bug-10484-131@http.sourceware.org/bugzilla/>
2011-01-07 17:41 ` [Bug libc/10484] getaddrinfo segfaults if /etc/hosts has a long line agl at imperialviolet dot org
2011-01-07 18:04 ` agl at imperialviolet dot org
2011-01-13 16:29 ` drepper.fsp at gmail dot com
2014-02-16 18:29 ` jackie.rosen at hushmail dot com
2014-05-28 19:46 ` schwab at sourceware dot org
2014-07-01  7:26 ` fweimer at redhat dot com
2009-08-05 15:22 [Bug libc/10484] New: " lars at ubuntu dot com
2009-08-05 19:29 ` [Bug libc/10484] " fibonacci dot prower at gmail dot com
2009-10-30  5:38 ` drepper at redhat dot com
2009-10-30 13:49 ` fibonacci dot prower at gmail dot com
2009-11-17  7:02 ` fibonacci dot prower at gmail dot com

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).