public inbox for glibc-cvs@sourceware.org help / color / mirror / Atom feed
From: Siddhesh Poyarekar <siddhesh@sourceware.org> To: glibc-cvs@sourceware.org Subject: [glibc/siddhesh/gai-cleanup2] gaih_inet: Fix CONTINUE and MERGE actions [BZ #28931] Date: Tue, 1 Mar 2022 02:41:02 +0000 (GMT) [thread overview] Message-ID: <20220301024102.37E4B3858418@sourceware.org> (raw) https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=878e14b58f8d70addb5a77c0d906a29c1195acd7 commit 878e14b58f8d70addb5a77c0d906a29c1195acd7 Author: Siddhesh Poyarekar <siddhesh@sourceware.org> Date: Mon Feb 28 14:52:05 2022 +0530 gaih_inet: Fix CONTINUE and MERGE actions [BZ #28931] The SUCCESS=MERGE action ends up writing to the same scratch buffer, in some cases referencing freed or invalid memory. Allocate proper memory for gethostbyname4_r lookups instead of using the scratch buffer so that all results are properly added in. SUCCESS=CONTINUE was acting the same as merge, which is incorrect. Flush existing results and start over if CONTINUE is encountered. Resolves: BZ #28931 Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org> Diff: --- sysdeps/posix/getaddrinfo.c | 31 +++++++++++++++++++++++++------ 1 file changed, 25 insertions(+), 6 deletions(-) diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c index 0173397fe1..43a8c7e266 100644 --- a/sysdeps/posix/getaddrinfo.c +++ b/sysdeps/posix/getaddrinfo.c @@ -864,10 +864,6 @@ gaih_inet (const char *name, const struct gaih_service *service, if (res_ctx == NULL) no_more = 1; - at = __alloca (sizeof (*at)); - at->next = NULL; - at->family = AF_UNSPEC; - while (!no_more) { no_data = 0; @@ -880,10 +876,14 @@ gaih_inet (const char *name, const struct gaih_service *service, if (fct4 != NULL) { + size_t length = 1024; + char *buf = malloc (length); + while (1) { + *pat = NULL; status = DL_CALL_FCT (fct4, (name, pat, - tmpbuf->data, tmpbuf->length, + buf, length, &errno, &h_errno, NULL)); if (status == NSS_STATUS_SUCCESS) @@ -898,7 +898,9 @@ gaih_inet (const char *name, const struct gaih_service *service, break; } - if (!scratch_buffer_grow (tmpbuf)) + length *= 2; + free (buf); + if ((buf = malloc (length)) == NULL) { __resolv_context_put (res_ctx); result = -EAI_MEMORY; @@ -906,6 +908,12 @@ gaih_inet (const char *name, const struct gaih_service *service, } } + if (!gaih_lookup_result_push_alloc (&res, buf)) + { + result = -EAI_MEMORY; + goto free_and_return; + } + if (status == NSS_STATUS_SUCCESS) { assert (!no_data); @@ -1037,6 +1045,17 @@ gaih_inet (const char *name, const struct gaih_service *service, if (nss_next_action (nip, status) == NSS_ACTION_RETURN) break; + /* Discard the previous result on CONTINUE. Allocations will get + freed at the end with func_cleanup, so only adjust PAT and free + CANONBUF if it was allocated. */ + if (nss_next_action (nip, status) == NSS_ACTION_CONTINUE) + { + at = NULL; + pat = &at; + free (canonbuf); + canon = canonbuf = NULL; + } + nip++; if (nip->module == NULL) no_more = -1;
reply other threads:[~2022-03-01 2:41 UTC|newest] Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20220301024102.37E4B3858418@sourceware.org \ --to=siddhesh@sourceware.org \ --cc=glibc-cvs@sourceware.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).