From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 2206) id 37E4B3858418; Tue, 1 Mar 2022 02:41:02 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 37E4B3858418 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Siddhesh Poyarekar To: glibc-cvs@sourceware.org Subject: [glibc/siddhesh/gai-cleanup2] gaih_inet: Fix CONTINUE and MERGE actions [BZ #28931] X-Act-Checkin: glibc X-Git-Author: Siddhesh Poyarekar X-Git-Refname: refs/heads/siddhesh/gai-cleanup2 X-Git-Oldrev: 38454ba670d978ee9a33fdbdab4f80bdd611907b X-Git-Newrev: 878e14b58f8d70addb5a77c0d906a29c1195acd7 Message-Id: <20220301024102.37E4B3858418@sourceware.org> Date: Tue, 1 Mar 2022 02:41:02 +0000 (GMT) X-BeenThere: glibc-cvs@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Glibc-cvs mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 01 Mar 2022 02:41:02 -0000 https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=878e14b58f8d70addb5a77c0d906a29c1195acd7 commit 878e14b58f8d70addb5a77c0d906a29c1195acd7 Author: Siddhesh Poyarekar Date: Mon Feb 28 14:52:05 2022 +0530 gaih_inet: Fix CONTINUE and MERGE actions [BZ #28931] The SUCCESS=MERGE action ends up writing to the same scratch buffer, in some cases referencing freed or invalid memory. Allocate proper memory for gethostbyname4_r lookups instead of using the scratch buffer so that all results are properly added in. SUCCESS=CONTINUE was acting the same as merge, which is incorrect. Flush existing results and start over if CONTINUE is encountered. Resolves: BZ #28931 Signed-off-by: Siddhesh Poyarekar Diff: --- sysdeps/posix/getaddrinfo.c | 31 +++++++++++++++++++++++++------ 1 file changed, 25 insertions(+), 6 deletions(-) diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c index 0173397fe1..43a8c7e266 100644 --- a/sysdeps/posix/getaddrinfo.c +++ b/sysdeps/posix/getaddrinfo.c @@ -864,10 +864,6 @@ gaih_inet (const char *name, const struct gaih_service *service, if (res_ctx == NULL) no_more = 1; - at = __alloca (sizeof (*at)); - at->next = NULL; - at->family = AF_UNSPEC; - while (!no_more) { no_data = 0; @@ -880,10 +876,14 @@ gaih_inet (const char *name, const struct gaih_service *service, if (fct4 != NULL) { + size_t length = 1024; + char *buf = malloc (length); + while (1) { + *pat = NULL; status = DL_CALL_FCT (fct4, (name, pat, - tmpbuf->data, tmpbuf->length, + buf, length, &errno, &h_errno, NULL)); if (status == NSS_STATUS_SUCCESS) @@ -898,7 +898,9 @@ gaih_inet (const char *name, const struct gaih_service *service, break; } - if (!scratch_buffer_grow (tmpbuf)) + length *= 2; + free (buf); + if ((buf = malloc (length)) == NULL) { __resolv_context_put (res_ctx); result = -EAI_MEMORY; @@ -906,6 +908,12 @@ gaih_inet (const char *name, const struct gaih_service *service, } } + if (!gaih_lookup_result_push_alloc (&res, buf)) + { + result = -EAI_MEMORY; + goto free_and_return; + } + if (status == NSS_STATUS_SUCCESS) { assert (!no_data); @@ -1037,6 +1045,17 @@ gaih_inet (const char *name, const struct gaih_service *service, if (nss_next_action (nip, status) == NSS_ACTION_RETURN) break; + /* Discard the previous result on CONTINUE. Allocations will get + freed at the end with func_cleanup, so only adjust PAT and free + CANONBUF if it was allocated. */ + if (nss_next_action (nip, status) == NSS_ACTION_CONTINUE) + { + at = NULL; + pat = &at; + free (canonbuf); + canon = canonbuf = NULL; + } + nip++; if (nip->module == NULL) no_more = -1;