Re: [PATCH v4] nss: reject invalid port passed to getaddrinfo [BZ #16208]

[Wilco Dijkstra <Wilco.Dijkstra@arm.com>]

Hi Antonio,

> @@ -414,7 +414,7 @@ get_servtuples (const struct gaih_service *service, const struct addrinfo *req,
>     if (service != NULL && (tp->protoflag & GAI_PROTO_NOSERVICE) != 0)
>       return -EAI_SERVICE;
>  
> -  if (service == NULL || service->num >= 0)
> +  if (service == NULL || (service->num >= 0 && service->num <= USHRT_MAX))

OK.

> @@ -2375,7 +2375,18 @@ getaddrinfo (const char *name, const char *service,
>              return EAI_NONAME;
>            }
>  
> -       gaih_service.num = -1;
> +       /* use an out-of-range value to report the parsing error */
> +       gaih_service.num = USHRT_MAX + 1;
> +     }
> +      /* port number must be in range [0, USHRT_MAX].
> +         Any other value is invalid.
> +         strtoul returns ULONG_MAX in case of out-of-range
> +         input and it is caught by this check */
> +      else if (gaih_service.num > USHRT_MAX)
> +     {
> +       /* the provided port number is invalid */
> +       __free_in6ai (in6ai);
> +       return EAI_NONAME;
>        }

So I'm still confused by this one - basically this treats "10000a" differently
from "100001". If the provided port number is a valid number but too large,
can we assume that AI_NUMERICSERV is set and return an error?

It may be better to treat it like an invalid port number, eg. something like:

      gaih_service.num = strtoul (gaih_service.name, &c, 10);
      /* port number must be a valid number with range [0, USHRT_MAX].
          strtoul returns ULONG_MAX in case of out-of-range.  */
      if (*c != '\0' || gaih_service.num > USHRT_MAX)
        {
          if (hints->ai_flags & AI_NUMERICSERV)
            {
              __free_in6ai (in6ai);
              return EAI_NONAME;
            }

          gaih_service.num = USHRT_MAX + 1;
        }

Cheers,
Wilco