This is the mail archive of the
libc-alpha@sourceware.org
mailing list for the glibc project.
Re: [PATCH] CVE-2016-3706: getaddrinfo: stack overflow in hostent conversion [BZ #20010]
- From: Florian Weimer <fweimer at redhat dot com>
- To: libc-alpha at sourceware dot org
- Date: Fri, 29 Apr 2016 10:37:51 +0200
- Subject: Re: [PATCH] CVE-2016-3706: getaddrinfo: stack overflow in hostent conversion [BZ #20010]
- Authentication-results: sourceware.org; auth=none
- References: <5720ACD2 dot 4030001 at redhat dot com>
On 04/27/2016 02:13 PM, Florian Weimer wrote:
When converting a struct hostent response to struct gaih_addrtuple, the
gethosts macro (which is called from gaih_inet) used alloca, without
malloc fallback for large responses. This commit changes this code to
use calloc unconditionally.
This commit also consolidated a second hostent-to-gaih_addrtuple
conversion loop (in gaih_inet) to use the new conversion function.
Tested with the external resolver tests. Valgrind shows no (new) memory
leaks.
I have committed this, with the following NEWS entry:
* Previously, getaddrinfo copied large amounts of address data to the stack,
even after the fix for CVE-2013-4458 has been applied, potentially
resulting in a stack overflow. getaddrinfo now uses a heap allocation
instead. Reported by Michael Petlan. (CVE-2016-3706)
Florian