blob: c33614afd7420f156231bd55615727ffe710777b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
|
From c602079e5b7ba998d1dd6cae4a305af80e6cba52 Mon Sep 17 00:00:00 2001
From: Gabor Juhos <juhosg@openwrt.org>
Date: Tue, 23 Mar 2010 08:35:27 +0100
Subject: [PATCH] Fix use-after-free bug in __dns_lookup.
If the type of the first answer does not match with the requested type,
then the dotted name will be freed. If there are no further answers in
the DNS reply, this pointer will be used later on in the same function.
Additionally it is passed to the caller, and may cause strange behaviour.
For example, the following busybox commands are triggering a segmentation
fault with uClibc 0.9.30.x
- nslookup ipv6.google.com
- ping ipv6.google.com
- wget http//ipv6.google.com/
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
---
See https://dev.openwrt.org/ticket/6886 for a testcase
---
libc/inet/resolv.c | 4 +---
1 files changed, 1 insertions(+), 3 deletions(-)
--- a/libc/inet/resolv.c
+++ b/libc/inet/resolv.c
@@ -1517,10 +1517,8 @@ int attribute_hidden __dns_lookup(const
memcpy(a, &ma, sizeof(ma));
if (a->atype != T_SIG && (NULL == a->buf || (type != T_A && type != T_AAAA)))
break;
- if (a->atype != type) {
- free(a->dotted);
+ if (a->atype != type)
continue;
- }
a->add_count = h.ancount - j - 1;
if ((a->rdlength + sizeof(struct in_addr*)) * a->add_count > a->buflen)
break;
|
