[Bug network/16002] New: calls to getaddrinfo() can segfault with large numbers of local ipaddrs.

[Bug network/16002] New: calls to getaddrinfo() can segfault with large numbers of local ipaddrs.

[dbavatar at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=16002

            Bug ID: 16002
           Summary: calls to getaddrinfo() can segfault with large numbers
                    of local ipaddrs.
           Product: glibc
           Version: 2.18
            Status: NEW
          Severity: normal
          Priority: P2
         Component: network
          Assignee: unassigned at sourceware dot org
          Reporter: dbavatar at gmail dot com

__check_pf() uses alloca() without checking input size (list of local ipaddrs),
eventually this will exceed the stack and segfault. Needs to be converted to
alloca_account with malloc fallback. Patch being send to libc-alpha.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug network/16002] calls to getaddrinfo() can segfault with large numbers of local ipaddrs.

[neleai at seznam dot cz]

https://sourceware.org/bugzilla/show_bug.cgi?id=16002

Ondrej Bilka <neleai at seznam dot cz> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mkubecek at suse dot cz

--- Comment #1 from Ondrej Bilka <neleai at seznam dot cz> ---
*** Bug 14806 has been marked as a duplicate of this bug. ***

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug network/16002] calls to getaddrinfo() can segfault with large numbers of local ipaddrs.

[schwab@linux-m68k.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=16002

--- Comment #2 from Andreas Schwab <schwab@linux-m68k.org> ---
# ip li add name dummy0 type dummy
# site_id=$(head -c6 /dev/urandom | od -tx2 -An | tr ' ' ':')
# for ((i = 0; i < 65536; i++)) do
> ip ad ad $(printf fd80$site_id::%04x $i)/128 dev dummy0
> done
# (ulimit -s 900; getent ahosts localhost)
# ip li de dummy0

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug network/16002] calls to getaddrinfo() can segfault with large numbers of local ipaddrs.

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=16002

--- Comment #3 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, master has been updated
       via  44152e4b05fcc8bae5628cdb37342d9b7bd5ac3c (commit)
      from  b376a11a19aa7b64107081e4eed2327c25a131be (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=44152e4b05fcc8bae5628cdb37342d9b7bd5ac3c

commit 44152e4b05fcc8bae5628cdb37342d9b7bd5ac3c
Author: Andreas Schwab <schwab@suse.de>
Date:   Mon Mar 24 11:06:30 2014 +0100

    Account for alloca use when collecting interface addresses (bug 16002)

    To reproduce:

        # ip li add name dummy0 type dummy
        # site_id=$(head -c6 /dev/urandom | od -tx2 -An | tr ' ' ':')
        # for ((i = 0; i < 65536; i++)) do
        > ip ad ad $(printf fd80$site_id::%04x $i)/128 dev dummy0
        > done
        # (ulimit -s 900; getent ahosts localhost)
        # ip li de dummy0

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog                          |    6 ++++++
 NEWS                               |    6 +++---
 sysdeps/unix/sysv/linux/check_pf.c |   32 ++++++++++++++++++++++++++++----
 3 files changed, 37 insertions(+), 7 deletions(-)

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug network/16002] calls to getaddrinfo() can segfault with large numbers of local ipaddrs.

[schwab@linux-m68k.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=16002

Andreas Schwab <schwab@linux-m68k.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
            Version|2.18                        |2.20
         Resolution|---                         |FIXED

--- Comment #4 from Andreas Schwab <schwab@linux-m68k.org> ---
Fixed in 2.20.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug network/16002] calls to getaddrinfo() can segfault with large numbers of local ipaddrs.

[schwab@linux-m68k.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=16002

Andreas Schwab <schwab@linux-m68k.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|2.20                        |2.18
   Target Milestone|---                         |2.20

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug network/16002] calls to getaddrinfo() can segfault with large numbers of local ipaddrs.

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=16002

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com
              Flags|                            |security-

--- Comment #5 from Florian Weimer <fweimer at redhat dot com> ---
Administrator privileges are required to add interface address, so this does
not cross a trust boundary.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug network/16002] calls to getaddrinfo() can segfault with large numbers of local ipaddrs.

[sam at gentoo dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=16002

Sam James <sam at gentoo dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |sam at gentoo dot org

-- 
You are receiving this mail because:
You are on the CC list for the bug.