summaryrefslogtreecommitdiff
path: root/resolv/nss_dns
diff options
context:
space:
mode:
authorFlorian Weimer <fweimer@redhat.com>2016-04-27 17:15:57 +0200
committerFlorian Weimer <fweimer@redhat.com>2016-04-27 17:15:57 +0200
commita12f9431b3808e78b9ed397e4fce7de69410d94d (patch)
tree06a218fb9d3d0f2ae31c333bbc42d151a6e42da7 /resolv/nss_dns
parentc3bae689d30c46c56c695d5b4c61b88e3b178d92 (diff)
downloadglibc-a12f9431b3808e78b9ed397e4fce7de69410d94d.tar.gz
nss_dns: Skip over non-PTR records in the netent code [BZ #19868]
This requires additional checks for the RDATA length and the availability of record metadata.
Diffstat (limited to 'resolv/nss_dns')
-rw-r--r--resolv/nss_dns/dns-network.c20
1 files changed, 18 insertions, 2 deletions
diff --git a/resolv/nss_dns/dns-network.c b/resolv/nss_dns/dns-network.c
index 99ec7555ab..3ae25c79a7 100644
--- a/resolv/nss_dns/dns-network.c
+++ b/resolv/nss_dns/dns-network.c
@@ -343,10 +343,23 @@ getanswer_r (const querybuf *answer, int anslen, struct netent *result,
if (n < 0 || res_dnok (bp) == 0)
break;
cp += n;
+
+ if (end_of_message - cp < 10)
+ {
+ __set_h_errno (NO_RECOVERY);
+ return NSS_STATUS_UNAVAIL;
+ }
+
GETSHORT (type, cp);
GETSHORT (class, cp);
cp += INT32SZ; /* TTL */
- GETSHORT (n, cp);
+ uint16_t rdatalen;
+ GETSHORT (rdatalen, cp);
+ if (end_of_message - cp < rdatalen)
+ {
+ __set_h_errno (NO_RECOVERY);
+ return NSS_STATUS_UNAVAIL;
+ }
if (class == C_IN && type == T_PTR)
{
@@ -368,7 +381,7 @@ getanswer_r (const querybuf *answer, int anslen, struct netent *result,
cp += n;
return NSS_STATUS_UNAVAIL;
}
- cp += n;
+ cp += rdatalen;
if (alias_pointer + 2 < &net_data->aliases[MAX_NR_ALIASES])
{
*alias_pointer++ = bp;
@@ -379,6 +392,9 @@ getanswer_r (const querybuf *answer, int anslen, struct netent *result,
++have_answer;
}
}
+ else
+ /* Skip over unknown record data. */
+ cp += rdatalen;
}
if (have_answer)