public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug libc/13013] New: assertion error in res_query.c
@ 2011-07-21 16:47 aurelien at aurel32 dot net
  2011-08-16  2:09 ` [Bug libc/13013] " nick.jones@network-box.com
                   ` (22 more replies)
  0 siblings, 23 replies; 24+ messages in thread
From: aurelien at aurel32 dot net @ 2011-07-21 16:47 UTC (permalink / raw)
  To: glibc-bugs

http://sourceware.org/bugzilla/show_bug.cgi?id=13013

           Summary: assertion error in res_query.c
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper.fsp@gmail.com
        ReportedBy: aurelien@aurel32.net


Created attachment 5855
  --> http://sourceware.org/bugzilla/attachment.cgi?id=5855
Patch to fix the issue

Commit 4769ae77fc6c8dacea6476addb015c8797848cdd a regression in the resolver
code, which trigger an assert in some conditions:

firefox-bin: res_query.c:251: __libc_res_nquery: Assertion `hp != hp2' failed.
Aborting.

When the first answer is a SERVFAIL, NOTIMP or REFUSED, resplen now got
assigned 0, while recvresp1 or recvresp2 is set to 1:

  /* No data from the first reply.  */
  resplen = 0;

When the second answer arrives, its buffer is allocated at *ansp + resplen,
which means in that case *ansp and *ansp2 are equals:

  *anssizp2 = orig_anssizp - resplen;
  *ansp2 = *ansp + resplen;

Given a second answer has still be provided, hp2 got assigned *answerp2, which
is the same than *answer (see above), so hp == hp2.

  HEADER *hp2 = answerp2 ? (HEADER *) *answerp2 : hp;

This is enough to trigger the assertion, that is the checks on the answer
buffers doesn't match the checks on the response lengths.

One way to fix that is to rewrite this part of the code to do all the checks on
the response lenghts. This is what the attached patch does.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.


^ permalink raw reply	[flat|nested] 24+ messages in thread
end of thread, other threads:[~2015-05-14 23:51 UTC | newest]

Thread overview: 24+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-07-21 16:47 [Bug libc/13013] New: assertion error in res_query.c aurelien at aurel32 dot net
2011-08-16  2:09 ` [Bug libc/13013] " nick.jones@network-box.com
2011-09-08 13:27 ` allan at archlinux dot org
2011-09-16  8:10 ` mmarek at suse dot cz
2011-10-29 16:04 ` pluto at agmk dot net
2011-10-29 16:43 ` arekm at maven dot pl
2011-12-19  3:23 ` fherrera at onirica dot com
2011-12-22  0:05 ` drepper.fsp at gmail dot com
2012-02-21  2:16 ` [Bug network/13013] " jsm28 at gcc dot gnu.org
2012-05-02 15:20 ` bugzilla at obra dot se
2012-05-17 18:39 ` bugzilla at obra dot se
2012-07-03  5:24 ` vapier at gentoo dot org
2012-10-09 21:34 ` timothy.c.pepper at linux dot intel.com
2012-10-09 21:41 ` timothy.c.pepper at linux dot intel.com
2012-10-10  0:31 ` law at redhat dot com
2012-10-10 17:29 ` timothy.c.pepper at linux dot intel.com
2012-10-10 18:22 ` arekm at maven dot pl
2012-10-11 18:36 ` law at redhat dot com
2012-11-30 20:06 ` davem at davemloft dot net
2014-02-16 19:42 ` jackie.rosen at hushmail dot com
2014-05-28 19:43 ` schwab at sourceware dot org
2014-06-27 12:53 ` fweimer at redhat dot com
2014-06-27 13:35 ` fweimer at redhat dot com
2015-05-14 23:51 ` pinskia at gcc dot gnu.org

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).