diff options
| author |   Florian Weimer <fweimer@redhat.com> | 2023-09-13 14:10:56 +0200 |
|---|---|---|
| committer |   Andreas K. Hüttel <dilfridge@gentoo.org> | 2023-09-16 11:34:07 +0200 |
| commit | 75357676237e8dcbb4d8fdd8e3526e598df9cf3a (patch) | |
| tree | cd6b840015bfbf04f5880aaaf7f39f2e4485f268 /sysdeps/i386/rawmemchr.S | |
| parent | elf: Move l_init_called_next to old place of l_text_end in link map (diff) | |
| download | glibc-75357676237e8dcbb4d8fdd8e3526e598df9cf3a.tar.gz glibc-75357676237e8dcbb4d8fdd8e3526e598df9cf3a.tar.bz2 glibc-75357676237e8dcbb4d8fdd8e3526e598df9cf3a.zip | |
CVE-2023-4527: Stack read overflow with large TCP responses in no-aaaa mode
Without passing alt_dns_packet_buffer, __res_context_search can only
store 2048 bytes (what fits into dns_packet_buffer). However,
the function returns the total packet size, and the subsequent
DNS parsing code in _nss_dns_gethostbyname4_r reads beyond the end
of the stack-allocated buffer.
Fixes commit f282cdbe7f436c75864e5640a4 ("resolv: Implement no-aaaa
stub resolver option") and bug 30842.
(cherry picked from commit bd77dd7e73e3530203be1c52c8a29d08270cb25d)
(cherry picked from commit b7529346025a130fee483d42178b5c118da971bb)
Diffstat (limited to 'sysdeps/i386/rawmemchr.S')
0 files changed, 0 insertions, 0 deletions