lib/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2025-08-01 10:06:57 +03:00
Code Activity

CVE-2016-10739: getaddrinfo: Fully parse IPv4 address strings [BZ #20018]

Browse Source 
The IPv4 address parser in the getaddrinfo function is changed so that
it does not ignore trailing whitespace and all characters after it.
For backwards compatibility, the getaddrinfo function still recognizes
legacy name syntax, such as 192.000.002.010 interpreted as 192.0.2.8
(octal).

This commit does not change the behavior of inet_addr and inet_aton.
gethostbyname already had additional sanity checks (but is switched
over to the new __inet_aton_exact function for completeness as well).

To avoid sending the problematic query names over DNS, commit
6ca53a2453 ("resolv: Do not send queries
for non-host-names in nss_dns [BZ #24112]") is needed.
This commit is contained in:
Florian Weimer
2019-01-21 21:26:03 +01:00
parent 5165de69c0
commit 108bc4049f
15 changed files with 455 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
resolv/res_init.c
View File

@ -399,8 +399,16 @@ res_vinit_1 (FILE *fp, struct resolv_conf_parser *parser)
cp = parser->buffer + sizeof ("nameserver") - 1;
while (*cp == ' ' || *cp == '\t')
cp++;
/* Ignore trailing contents on the name server line. */
{
char *el;
if ((el = strpbrk (cp, " \t\n")) != NULL)
*el = '\0';
}
struct sockaddr *sa;
if ((*cp != '\0') && (*cp != '\n') && __inet_aton (cp, &a))
if ((*cp != '\0') && (*cp != '\n') && __inet_aton_exact (cp, &a))
{
sa = allocate_address_v4 (a, NAMESERVER_PORT);
if (sa == NULL)
@ -410,9 +418,6 @@ res_vinit_1 (FILE *fp, struct resolv_conf_parser *parser)
{
struct in6_addr a6;
char *el;
if ((el = strpbrk (cp, " \t\n")) != NULL)
*el = '\0';
if ((el = strchr (cp, SCOPE_DELIMITER)) != NULL)
*el = '\0';
if ((*cp != '\0') && (__inet_pton (AF_INET6, cp, &a6) > 0))
@ -472,7 +477,7 @@ res_vinit_1 (FILE *fp, struct resolv_conf_parser *parser)
char separator = *cp;
*cp = 0;
struct resolv_sortlist_entry e;
if (__inet_aton (net, &a))
if (__inet_aton_exact (net, &a))
{
e.addr = a;
if (is_sort_mask (separator))
@ -484,7 +489,7 @@ res_vinit_1 (FILE *fp, struct resolv_conf_parser *parser)
cp++;
separator = *cp;
*cp = 0;
if (__inet_aton (net, &a))
if (__inet_aton_exact (net, &a))
e.mask = a.s_addr;
else
e.mask = net_mask (e.addr);