[Bug libc/31025] New: infinite loop in sortlist handling

[Bug libc/31025] New: infinite loop in sortlist handling

[joshua at joshua dot hu]

https://sourceware.org/bugzilla/show_bug.cgi?id=31025

            Bug ID: 31025
           Summary: infinite loop in sortlist handling
           Product: glibc
           Version: 2.40
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: joshua at joshua dot hu
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---
             Flags: security?

Hi there,

I have found an infinite loop in resolv's handling of the "sortlist" option.

The issue resides in resolv/res_init.c:


              while (true)
                {
                  while (*cp == ' ' || *cp == '\t')
                    cp++;
                  if (*cp == '\0' || *cp == '\n' || *cp == ';')
                    break;
                  char *net = cp;
                  while (*cp && !is_sort_mask (*cp) && *cp != ';'
                         && isascii (*cp) && !isspace (*cp))
                    cp++;
                  char separator = *cp;
                  *cp = 0;
                  struct resolv_sortlist_entry e;
                  if (__inet_aton (net, &a))
                    {
                      [..]
                    }
                  *cp = separator;
                }

If __inet_aton() returns false, the value of the sortlist option is repeatedly
tried over and over, leading to an infinite loop.

A quick example: printf "sortlist 192.0\3212.0" >> /etc/resolv.conf ; ping
example.com

Setting this option on some type of embedded devices (think: switches, modems,
BMCs, and so on, which likely have some type of option to change
/etc/resolv.conf) will likely be completely bricked after a reboot. Any call to
res_init either implicitly or explicitly will hang forever.

I'm not sure the best fix here, as it's not obvious to me whether invalid
sortlist values are "allowed" (in the sense that they are skipped and
processing continues if there is still other values), or one invalid value
negates the whole line.


Cheers,
Josh

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug network/31025] infinite loop in sortlist handling

[joshua at joshua dot hu]

https://sourceware.org/bugzilla/show_bug.cgi?id=31025

Joshua Rogers <joshua at joshua dot hu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|libc                        |network

-- 
You are receiving this mail because:
You are on the CC list for the bug.