Home / exploits

PDF

Glibc AF_INET6 stack overflow

Posted on 23 October 2013

This patch fixes another stack overflow in getaddrinfo when it is
called with AF_INET6.  The AF_UNSPEC case was fixed as CVE-2013-1914,
but the AF_INET case went undetected back then.

Tested on x86_64 - same reproducer as 16071, with AF_INET6 instead of
AF_INET.  OK to commit?  Also, should I add another NEWS item for this
with this CVE number or should I post a request for another CVE?

Siddhesh

	[BZ #16072]
	* sysdeps/posix/getaddrinfo.c (gethosts): Allocate tmpbuf on
	heap for large requests.


diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
index 0f4b885..4919d90 100644
--- a/sysdeps/posix/getaddrinfo.c
+++ b/sysdeps/posix/getaddrinfo.c
@@ -197,7 +197,21 @@ gaih_inet_serv (const char *servicename, const struct gaih_typeproto *tp,
 				&rc, &herrno, NULL, &localcanon));	      
     if (rc != ERANGE || herrno != NETDB_INTERNAL)			      
       break;								      
-    tmpbuf = extend_alloca (tmpbuf, tmpbuflen, 2 * tmpbuflen);		      
+    if (!malloc_tmpbuf && __libc_use_alloca (alloca_used + 2 * tmpbuflen))    
+      tmpbuf = extend_alloca (tmpbuf, tmpbuflen, 2 * tmpbuflen);	      
+    else								      
+      {									      
+	char *newp = realloc (malloc_tmpbuf ? tmpbuf : NULL,		      
+			      2 * tmpbuflen);				      
+	if (newp == NULL)						      
+	  {								      
+	    result = -EAI_MEMORY;					      
+	    goto free_and_return;					      
+	  }								      
+	tmpbuf = newp;							      
+	malloc_tmpbuf = true;						      
+	tmpbuflen = 2 * tmpbuflen;					      
+      }									      
   }									      
   if (status == NSS_STATUS_SUCCESS && rc == 0)				      
     h = &th;								      
@@ -209,7 +223,8 @@ gaih_inet_serv (const char *servicename, const struct gaih_typeproto *tp,
 	{								      
 	  __set_h_errno (herrno);					      
 	  _res.options |= old_res_options & RES_USE_INET6;		      
-	  return -EAI_SYSTEM;						      
+	  result = -EAI_SYSTEM;						      
+	  goto free_and_return;						      
 	}								      
       if (herrno == TRY_AGAIN)						      
 	no_data = EAI_AGAIN;

 

TOP