[Bug libc/13013] New: assertion error in res_query.c

[Bug libc/13013] New: assertion error in res_query.c

[aurelien at aurel32 dot net]

http://sourceware.org/bugzilla/show_bug.cgi?id=13013

           Summary: assertion error in res_query.c
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper.fsp@gmail.com
        ReportedBy: aurelien@aurel32.net


Created attachment 5855
  --> http://sourceware.org/bugzilla/attachment.cgi?id=5855
Patch to fix the issue

Commit 4769ae77fc6c8dacea6476addb015c8797848cdd a regression in the resolver
code, which trigger an assert in some conditions:

firefox-bin: res_query.c:251: __libc_res_nquery: Assertion `hp != hp2' failed.
Aborting.

When the first answer is a SERVFAIL, NOTIMP or REFUSED, resplen now got
assigned 0, while recvresp1 or recvresp2 is set to 1:

  /* No data from the first reply.  */
  resplen = 0;

When the second answer arrives, its buffer is allocated at *ansp + resplen,
which means in that case *ansp and *ansp2 are equals:

  *anssizp2 = orig_anssizp - resplen;
  *ansp2 = *ansp + resplen;

Given a second answer has still be provided, hp2 got assigned *answerp2, which
is the same than *answer (see above), so hp == hp2.

  HEADER *hp2 = answerp2 ? (HEADER *) *answerp2 : hp;

This is enough to trigger the assertion, that is the checks on the answer
buffers doesn't match the checks on the response lengths.

One way to fix that is to rewrite this part of the code to do all the checks on
the response lenghts. This is what the attached patch does.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13013] assertion error in res_query.c

[nick.jones@network-box.com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13013

nick.jones@network-box.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |nick.jones@network-box.com

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13013] assertion error in res_query.c

[allan at archlinux dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=13013

Allan McRae <allan at archlinux dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |allan at archlinux dot org

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13013] assertion error in res_query.c

[mmarek at suse dot cz]

http://sourceware.org/bugzilla/show_bug.cgi?id=13013

Michal Marek <mmarek at suse dot cz> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mmarek at suse dot cz

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13013] assertion error in res_query.c

[pluto at agmk dot net]

http://sourceware.org/bugzilla/show_bug.cgi?id=13013

Pawel Sikora <pluto at agmk dot net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |pluto at agmk dot net

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13013] assertion error in res_query.c

[arekm at maven dot pl]

http://sourceware.org/bugzilla/show_bug.cgi?id=13013

Arkadiusz Miskiewicz <arekm at maven dot pl> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |arekm at maven dot pl

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13013] assertion error in res_query.c

[fherrera at onirica dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13013

--- Comment #1 from Fernando Herrera <fherrera at onirica dot com> 2011-12-19 03:22:03 UTC ---
Created attachment 6118
  --> http://sourceware.org/bugzilla/attachment.cgi?id=6118
testcase for this bug

This testcase triggers the bug using these nameservers:

nameserver 87.216.1.65
nameserver 87.216.1.66

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13013] assertion error in res_query.c

[drepper.fsp at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13013

--- Comment #2 from Ulrich Drepper <drepper.fsp at gmail dot com> 2011-12-22 00:04:28 UTC ---
(In reply to comment #1)
> Created attachment 6118 [details]
> testcase for this bug
> 
> This testcase triggers the bug using these nameservers:
> 
> nameserver 87.216.1.65
> nameserver 87.216.1.66

No, it doesn't.  I don't see any assert.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug network/13013] assertion error in res_query.c

[jsm28 at gcc dot gnu.org]

http://sourceware.org/bugzilla/show_bug.cgi?id=13013

Joseph Myers <jsm28 at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|libc                        |network

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug network/13013] assertion error in res_query.c

[bugzilla at obra dot se]

http://sourceware.org/bugzilla/show_bug.cgi?id=13013

bugzilla at obra dot se changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |bugzilla at obra dot se

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug network/13013] assertion error in res_query.c

[bugzilla at obra dot se]

http://sourceware.org/bugzilla/show_bug.cgi?id=13013

--- Comment #3 from bugzilla at obra dot se 2012-05-17 18:38:26 UTC ---
I see this too (as does everyone else who uses a non-patched glibc). Hope to
see this fixed in 2.15.1

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug network/13013] assertion error in res_query.c

[vapier at gentoo dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=13013

Mike Frysinger <vapier at gentoo dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |toolchain at gentoo dot org
            Version|unspecified                 |2.14
   Target Milestone|---                         |2.17

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug network/13013] assertion error in res_query.c

[timothy.c.pepper at linux dot intel.com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13013

Tim Pepper <timothy.c.pepper at linux dot intel.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |timothy.c.pepper at linux
                   |                            |dot intel.com

--- Comment #4 from Tim Pepper <timothy.c.pepper at linux dot intel.com> 2012-10-09 21:33:47 UTC ---
I was lazy and edited an scp command in my shell history to be an ssh command,
but forgot to remove the ':', eg:

   scp file host:/big/long/path
   ssh host: command /big/long/path

That ssh command resulted in the assert noted here, but only on a first try. 
I'm guessing the query/result is cached and traverses different code
subsequently and gives a more expected output like:

   ssh: Could not resolve hostname host:: Name or service not known

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug network/13013] assertion error in res_query.c

[timothy.c.pepper at linux dot intel.com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13013

Tim Pepper <timothy.c.pepper at linux dot intel.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|2.14                        |2.16

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug network/13013] assertion error in res_query.c

[law at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13013

law at redhat dot com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |law at redhat dot com

--- Comment #5 from law at redhat dot com 2012-10-10 00:31:40 UTC ---
Tim, what are the contents of your resolv.conf?  

This issue is highly dependent on the nameservers you use and unfortunately
nobody's been able to trigger on public nameservers.  I worked with  Fernando
on analysis in the past, but wasn't able to wrap up before having to switch to
another issue.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug network/13013] assertion error in res_query.c

[timothy.c.pepper at linux dot intel.com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13013

--- Comment #6 from Tim Pepper <timothy.c.pepper at linux dot intel.com> 2012-10-10 17:28:47 UTC ---
(In reply to comment #5)
> Tim, what are the contents of your resolv.conf?  

I'm using connman, so my /etc/resolv.conf has simply:
    # Generated by Connection Manager
    nameserver 127.0.0.1

connman's then using whatever company internal dns server(s) the local
corporate dhcp server told it to use...

It's quite easy for me to reproduce, with the exception of not having figured
out what's being seemingly cached or where.  If there's anything you'd suggest
for added instrumentation in glibc, to look for in the corefile, look for in a
tcpdump, etc., let me know and I will dig a layer deeper.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug network/13013] assertion error in res_query.c

[arekm at maven dot pl]

http://sourceware.org/bugzilla/show_bug.cgi?id=13013

Arkadiusz Miskiewicz <arekm at maven dot pl> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|arekm at maven dot pl       |

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug network/13013] assertion error in res_query.c

[law at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13013

--- Comment #7 from law at redhat dot com 2012-10-11 18:35:48 UTC ---
Unfortunately, we're obviously not going to be able to access the DNS server
running on your local host.

It's certainly relatively easy to reproduce once you've got a nameserver which
triggers the problem -- but that's been the incredibly frustrating problem
here.  Every such name server has been behind a firewall.

Given there's a potential patch attached to this BZ, what's really needed is
for someone with better knowledge of this code to review that patch.  I don't
feel qualified to do that review.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug network/13013] assertion error in res_query.c

[davem at davemloft dot net]

http://sourceware.org/bugzilla/show_bug.cgi?id=13013

David S. Miller <davem at davemloft dot net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
                 CC|                            |davem at davemloft dot net
         Resolution|                            |FIXED

--- Comment #8 from David S. Miller <davem at davemloft dot net> 2012-11-30 20:05:56 UTC ---
Fixed in glibc-2.17

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug network/13013] assertion error in res_query.c

[jackie.rosen at hushmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=13013

Jackie Rosen <jackie.rosen at hushmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jackie.rosen at hushmail dot com

--- Comment #9 from Jackie Rosen <jackie.rosen at hushmail dot com> ---
*** Bug 260998 has been marked as a duplicate of this bug. ***
Seen from the domain http://volichat.com
Page where seen: http://volichat.com/adult-chat-rooms
Marked for reference. Resolved as fixed @bugzilla.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug network/13013] assertion error in res_query.c

[schwab at sourceware dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=13013

Andreas Schwab <schwab at sourceware dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|jackie.rosen at hushmail dot com   |

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug network/13013] assertion error in res_query.c

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=13013

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com
              Flags|                            |security+

--- Comment #10 from Florian Weimer <fweimer at redhat dot com> ---
I think this can be triggered by (untrusted) authoritative servers with some
resolvers, so it this is a denial-of-service vulnerability.

Commit 4769ae77fc6c8dacea6476addb015c8797848cdd (see comment #1) went into
glibc 2.14, so versions from 2.14 to 2.16 are affected by this.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug network/13013] assertion error in res_query.c

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=13013

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://sourceware.org/bugz
                   |                            |illa/show_bug.cgi?id=12684

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug network/13013] assertion error in res_query.c

[pinskia at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=13013

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |pinskia at gcc dot gnu.org

--- Comment #11 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Just for reference since I did not see it in this bug, the commit was done as:
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=cc8bb21c8ad619148c022af6e39ca8a5086a6a88

-- 
You are receiving this mail because:
You are on the CC list for the bug.