summaryrefslogtreecommitdiff
path: root/toolchain/uClibc/patches-0.9.30.1/902-Fix-use-after-free-bug-in-__dns_lookup.patch
diff options
context:
space:
mode:
authorjuhosg <juhosg@3c298f89-4303-0410-b956-a3cf2f4a3e73>2010-03-23 08:12:24 +0000
committerjuhosg <juhosg@3c298f89-4303-0410-b956-a3cf2f4a3e73>2010-03-23 08:12:24 +0000
commitfadc950fd9ccc9eecb6766b4920e77353ebc2596 (patch)
tree7a2dfe45f29b1b13c7a6e15cc2c079d1381a45bb /toolchain/uClibc/patches-0.9.30.1/902-Fix-use-after-free-bug-in-__dns_lookup.patch
parent198af969411e3c43da456decba6bfb88666c8e6c (diff)
uClibc: fix free-after-use bug in __dns_lookup (closes #6886)
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@20384 3c298f89-4303-0410-b956-a3cf2f4a3e73
Diffstat (limited to 'toolchain/uClibc/patches-0.9.30.1/902-Fix-use-after-free-bug-in-__dns_lookup.patch')
-rw-r--r--toolchain/uClibc/patches-0.9.30.1/902-Fix-use-after-free-bug-in-__dns_lookup.patch45
1 files changed, 45 insertions, 0 deletions
diff --git a/toolchain/uClibc/patches-0.9.30.1/902-Fix-use-after-free-bug-in-__dns_lookup.patch b/toolchain/uClibc/patches-0.9.30.1/902-Fix-use-after-free-bug-in-__dns_lookup.patch
new file mode 100644
index 0000000000..3a6f43d340
--- /dev/null
+++ b/toolchain/uClibc/patches-0.9.30.1/902-Fix-use-after-free-bug-in-__dns_lookup.patch
@@ -0,0 +1,45 @@
+From c602079e5b7ba998d1dd6cae4a305af80e6cba52 Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Tue, 23 Mar 2010 08:35:27 +0100
+Subject: [PATCH] Fix use-after-free bug in __dns_lookup.
+
+If the type of the first answer does not match with the requested type,
+then the dotted name will be freed. If there are no further answers in
+the DNS reply, this pointer will be used later on in the same function.
+Additionally it is passed to the caller, and may cause strange behaviour.
+
+For example, the following busybox commands are triggering a segmentation
+fault with uClibc 0.9.30.x
+
+ - nslookup ipv6.google.com
+ - ping ipv6.google.com
+ - wget http//ipv6.google.com/
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+
+---
+
+See https://dev.openwrt.org/ticket/6886 for a testcase
+---
+ libc/inet/resolv.c | 4 +---
+ 1 files changed, 1 insertions(+), 3 deletions(-)
+
+diff --git a/libc/inet/resolv.c b/libc/inet/resolv.c
+index 0a6fd7a..e76f0aa 100644
+--- a/libc/inet/resolv.c
++++ b/libc/inet/resolv.c
+@@ -1501,10 +1501,8 @@ int attribute_hidden __dns_lookup(const char *name,
+ memcpy(a, &ma, sizeof(ma));
+ if (a->atype != T_SIG && (NULL == a->buf || (type != T_A && type != T_AAAA)))
+ break;
+- if (a->atype != type) {
+- free(a->dotted);
++ if (a->atype != type)
+ continue;
+- }
+ a->add_count = h.ancount - j - 1;
+ if ((a->rdlength + sizeof(struct in_addr*)) * a->add_count > a->buflen)
+ break;
+--
+1.5.3.2
+