toolchain/uClibc/patches-0.9.31/902-Fix-use-after-free-bug-in-__dns_lookup.patch

   1 From c602079e5b7ba998d1dd6cae4a305af80e6cba52 Mon Sep 17 00:00:00 2001
   2 From: Gabor Juhos <juhosg@openwrt.org>
   3 Date: Tue, 23 Mar 2010 08:35:27 +0100
   4 Subject: [PATCH] Fix use-after-free bug in __dns_lookup.
   5
   6 If the type of the first answer does not match with the requested type,
   7 then the dotted name will be freed. If there are no further answers in
   8 the DNS reply, this pointer will be used later on in the same function.
   9 Additionally it is passed to the caller, and may cause strange behaviour.
  10
  11 For example, the following busybox commands are triggering a segmentation
  12 fault with uClibc 0.9.30.x
  13
  14   - nslookup ipv6.google.com
  15   - ping ipv6.google.com
  16   - wget http//ipv6.google.com/
  17
  18 Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  19
  20 ---
  21
  22 See https://dev.openwrt.org/ticket/6886 for a testcase
  23 ---
  24  libc/inet/resolv.c |    4 +---
  25  1 files changed, 1 insertions(+), 3 deletions(-)
  26
  27 --- a/libc/inet/resolv.c
  28 +++ b/libc/inet/resolv.c
  29 @@ -1517,10 +1517,8 @@ int attribute_hidden __dns_lookup(const
  30                                 memcpy(a, &ma, sizeof(ma));
  31                                 if (a->atype != T_SIG && (NULL == a->buf || (type != T_A && type != T_AAAA)))
  32                                         break;
  33 -                               if (a->atype != type) {
  34 -                                       free(a->dotted);
  35 +                               if (a->atype != type)
  36                                         continue;
  37 -                               }
  38                                 a->add_count = h.ancount - j - 1;
  39                                 if ((a->rdlength + sizeof(struct in_addr*)) * a->add_count > a->buflen)
  40                                         break;