aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorFlorian Weimer <fweimer@redhat.com>2014-12-15 17:41:13 +0100
committerAllan McRae <allan@archlinux.org>2014-12-18 11:06:19 +1000
commitf80af76648ed97a76745fad6caa3315a79cb1c7c (patch)
treee5c8cc05d943581a0c10bbe7c2333b3572370e69
parenta3a1f4163c4d0f9a36056c8640661a88674ae8a2 (diff)
downloadtermbaud-f80af76648ed97a76745fad6caa3315a79cb1c7c.tar.gz
termbaud-f80af76648ed97a76745fad6caa3315a79cb1c7c.tar.xz
termbaud-f80af76648ed97a76745fad6caa3315a79cb1c7c.zip
Avoid infinite loop in nss_dns getnetbyname [BZ #17630]
(cherry picked from commit 11e3417af6e354f1942c68a271ae51e892b2814d) (cherry picked from commit e54db0ea6a49affac43fa305fd134f3020c41382) Conflicts: NEWS
-rw-r--r--ChangeLog6
-rw-r--r--NEWS8
-rw-r--r--resolv/nss_dns/dns-network.c4
3 files changed, 14 insertions, 4 deletions
diff --git a/ChangeLog b/ChangeLog
index 88d2f1edde7..e416cd0e62c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2014-12-16 Florian Weimer <fweimer@redhat.com>
+
+ [BZ #17630]
+ * resolv/nss_dns/dns-network.c (getanswer_r): Iterate over alias
+ names.
+
2014-12-15 Jeff Law <law@redhat.com>
[BZ #16617]
diff --git a/NEWS b/NEWS
index f6cdb661422..9bc835c4d17 100644
--- a/NEWS
+++ b/NEWS
@@ -9,7 +9,7 @@ Version 2.20.1
* The following bugs are resolved with this release:
- 16617, 17266, 17370, 17371, 17460, 17485, 17555, 17625.
+ 16617, 17266, 17370, 17371, 17460, 17485, 17555, 17625, 17630.
* CVE-2104-7817 The wordexp function could ignore the WRDE_NOCMD flag
under certain input conditions resulting in the execution of a shell for
@@ -18,7 +18,11 @@ Version 2.20.1
shell and returns the error WRDE_CMDSUB as expected.
* CVE-2012-3406 printf-style functions could run into a stack overflow when
- processing format strings with a large number of format specifiers.a
+ processing format strings with a large number of format specifiers.
+
+* CVE-2014-9402 The nss_dns implementation of getnetbyname could run into an
+ infinite loopif the DNS response contained a PTR record of an unexpected
+ format.
Version 2.20
diff --git a/resolv/nss_dns/dns-network.c b/resolv/nss_dns/dns-network.c
index 0a77c8bc480..08cf0a6462c 100644
--- a/resolv/nss_dns/dns-network.c
+++ b/resolv/nss_dns/dns-network.c
@@ -398,8 +398,8 @@ getanswer_r (const querybuf *answer, int anslen, struct netent *result,
case BYNAME:
{
- char **ap = result->n_aliases++;
- while (*ap != NULL)
+ char **ap;
+ for (ap = result->n_aliases; *ap != NULL; ++ap)
{
/* Check each alias name for being of the forms:
4.3.2.1.in-addr.arpa = net 1.2.3.4