summaryrefslogtreecommitdiff
path: root/toolchain/uClibc/patches-0.9.30.3/902-Fix-use-after-free-bug-in-__dns_lookup.patch
diff options
context:
space:
mode:
authorkaloz <kaloz@3c298f89-4303-0410-b956-a3cf2f4a3e73>2010-11-02 12:56:58 +0000
committerkaloz <kaloz@3c298f89-4303-0410-b956-a3cf2f4a3e73>2010-11-02 12:56:58 +0000
commitad0b1804803739a4de015f8e8b91beda4cd8dfc8 (patch)
tree533b39262ae5209d99f2a374052429b8a6d5bbe0 /toolchain/uClibc/patches-0.9.30.3/902-Fix-use-after-free-bug-in-__dns_lookup.patch
parentc73605b3b6b3861b6d99127780092307968acc63 (diff)
[toolchain]: remove support for uClibc 0.9.30.2 and 0.9.30.3
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23779 3c298f89-4303-0410-b956-a3cf2f4a3e73
Diffstat (limited to 'toolchain/uClibc/patches-0.9.30.3/902-Fix-use-after-free-bug-in-__dns_lookup.patch')
-rw-r--r--toolchain/uClibc/patches-0.9.30.3/902-Fix-use-after-free-bug-in-__dns_lookup.patch45
1 files changed, 0 insertions, 45 deletions
diff --git a/toolchain/uClibc/patches-0.9.30.3/902-Fix-use-after-free-bug-in-__dns_lookup.patch b/toolchain/uClibc/patches-0.9.30.3/902-Fix-use-after-free-bug-in-__dns_lookup.patch
deleted file mode 100644
index 3a6f43d340..0000000000
--- a/toolchain/uClibc/patches-0.9.30.3/902-Fix-use-after-free-bug-in-__dns_lookup.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From c602079e5b7ba998d1dd6cae4a305af80e6cba52 Mon Sep 17 00:00:00 2001
-From: Gabor Juhos <juhosg@openwrt.org>
-Date: Tue, 23 Mar 2010 08:35:27 +0100
-Subject: [PATCH] Fix use-after-free bug in __dns_lookup.
-
-If the type of the first answer does not match with the requested type,
-then the dotted name will be freed. If there are no further answers in
-the DNS reply, this pointer will be used later on in the same function.
-Additionally it is passed to the caller, and may cause strange behaviour.
-
-For example, the following busybox commands are triggering a segmentation
-fault with uClibc 0.9.30.x
-
- - nslookup ipv6.google.com
- - ping ipv6.google.com
- - wget http//ipv6.google.com/
-
-Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-
----
-
-See https://dev.openwrt.org/ticket/6886 for a testcase
----
- libc/inet/resolv.c | 4 +---
- 1 files changed, 1 insertions(+), 3 deletions(-)
-
-diff --git a/libc/inet/resolv.c b/libc/inet/resolv.c
-index 0a6fd7a..e76f0aa 100644
---- a/libc/inet/resolv.c
-+++ b/libc/inet/resolv.c
-@@ -1501,10 +1501,8 @@ int attribute_hidden __dns_lookup(const char *name,
- memcpy(a, &ma, sizeof(ma));
- if (a->atype != T_SIG && (NULL == a->buf || (type != T_A && type != T_AAAA)))
- break;
-- if (a->atype != type) {
-- free(a->dotted);
-+ if (a->atype != type)
- continue;
-- }
- a->add_count = h.ancount - j - 1;
- if ((a->rdlength + sizeof(struct in_addr*)) * a->add_count > a->buflen)
- break;
---
-1.5.3.2
-