diff --git a/.gitignore b/.gitignore index 4f633d2..d25adae 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1 @@ -SOURCES/c-ares-1.13.0.tar.gz -/c-ares-1.13.0.tar.gz +c-ares-1.34.6.tar.gz diff --git a/0001-Use-RPM-compiler-options.patch b/0001-Use-RPM-compiler-options.patch deleted file mode 100644 index 721b713..0000000 --- a/0001-Use-RPM-compiler-options.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 7dada62a77e061c752123e672e844386ff3b01ea Mon Sep 17 00:00:00 2001 -From: Stephen Gallagher -Date: Wed, 10 Apr 2013 12:32:44 -0400 -Subject: [PATCH] Use RPM compiler options - ---- - m4/cares-compilers.m4 | 19 ++++++------------- - 1 file changed, 6 insertions(+), 13 deletions(-) - -diff --git a/m4/cares-compilers.m4 b/m4/cares-compilers.m4 -index 7ee8e0dbe741c1a64149a0d20b826f507b3ec620..d7708230fb5628ae80fbf1052da0d2c78ebbc160 100644 ---- a/m4/cares-compilers.m4 -+++ b/m4/cares-compilers.m4 -@@ -143,19 +143,12 @@ AC_DEFUN([CARES_CHECK_COMPILER_GNU_C], [ - gccvhi=`echo $gccver | cut -d . -f1` - gccvlo=`echo $gccver | cut -d . -f2` - compiler_num=`(expr $gccvhi "*" 100 + $gccvlo) 2>/dev/null` -- flags_dbg_all="-g -g0 -g1 -g2 -g3" -- flags_dbg_all="$flags_dbg_all -ggdb" -- flags_dbg_all="$flags_dbg_all -gstabs" -- flags_dbg_all="$flags_dbg_all -gstabs+" -- flags_dbg_all="$flags_dbg_all -gcoff" -- flags_dbg_all="$flags_dbg_all -gxcoff" -- flags_dbg_all="$flags_dbg_all -gdwarf-2" -- flags_dbg_all="$flags_dbg_all -gvms" -- flags_dbg_yes="-g" -- flags_dbg_off="-g0" -- flags_opt_all="-O -O0 -O1 -O2 -O3 -Os" -- flags_opt_yes="-O2" -- flags_opt_off="-O0" -+ flags_dbg_all="" -+ flags_dbg_yes="" -+ flags_dbg_off="" -+ flags_opt_all="" -+ flags_opt_yes="" -+ flags_opt_off="" - CURL_CHECK_DEF([_WIN32], [], [silent]) - else - AC_MSG_RESULT([no]) --- -1.8.1.4 diff --git a/0002-fix-CVE-2021-3672.patch b/0002-fix-CVE-2021-3672.patch deleted file mode 100644 index 9dc7f31..0000000 --- a/0002-fix-CVE-2021-3672.patch +++ /dev/null @@ -1,198 +0,0 @@ -From 4bde615c5fa2a6a6f61ca533e46a062691d83f45 Mon Sep 17 00:00:00 2001 -From: bradh352 -Date: Fri, 11 Jun 2021 11:27:45 -0400 -Subject: [PATCH 1/2] ares_expand_name() should escape more characters - -RFC1035 5.1 specifies some reserved characters and escaping sequences -that are allowed to be specified. Expand the list of reserved characters -and also escape non-printable characters using the \DDD format as -specified in the RFC. - -Bug Reported By: philipp.jeitner@sit.fraunhofer.de -Fix By: Brad House (@bradh352) ---- - ares_expand_name.c | 41 ++++++++++++++++++++++++++++++++++++++--- - 1 file changed, 38 insertions(+), 3 deletions(-) - -diff --git a/ares_expand_name.c b/ares_expand_name.c -index 3a38e67..8604543 100644 ---- a/ares_expand_name.c -+++ b/ares_expand_name.c -@@ -38,6 +38,26 @@ - static int name_length(const unsigned char *encoded, const unsigned char *abuf, - int alen); - -+/* Reserved characters for names that need to be escaped */ -+static int is_reservedch(int ch) -+{ -+ switch (ch) { -+ case '"': -+ case '.': -+ case ';': -+ case '\\': -+ case '(': -+ case ')': -+ case '@': -+ case '$': -+ return 1; -+ default: -+ break; -+ } -+ -+ return 0; -+} -+ - /* Expand an RFC1035-encoded domain name given by encoded. The - * containing message is given by abuf and alen. The result given by - * *s, which is set to a NUL-terminated allocated buffer. *enclen is -@@ -117,9 +137,18 @@ int ares_expand_name(const unsigned char *encoded, const unsigned char *abuf, - p++; - while (len--) - { -- if (*p == '.' || *p == '\\') -+ if (!isprint(*p)) { -+ /* Output as \DDD for consistency with RFC1035 5.1 */ -+ *q++ = '\\'; -+ *q++ = '0' + *p / 100; -+ *q++ = '0' + (*p % 100) / 10; -+ *q++ = '0' + (*p % 10); -+ } else if (is_reservedch(*p)) { - *q++ = '\\'; -- *q++ = *p; -+ *q++ = *p; -+ } else { -+ *q++ = *p; -+ } - p++; - } - *q++ = '.'; -@@ -177,7 +206,13 @@ static int name_length(const unsigned char *encoded, const unsigned char *abuf, - encoded++; - while (offset--) - { -- n += (*encoded == '.' || *encoded == '\\') ? 2 : 1; -+ if (!isprint(*encoded)) { -+ n += 4; -+ } else if (is_reservedch(*encoded)) { -+ n += 2; -+ } else { -+ n += 1; -+ } - encoded++; - } - n++; --- -2.26.3 - - -From 86cc9241f89c1155111b992ccc03bf76d8ae634a Mon Sep 17 00:00:00 2001 -From: bradh352 -Date: Fri, 11 Jun 2021 12:39:24 -0400 -Subject: [PATCH 2/2] ares_expand_name(): fix formatting and handling of root - name response - -Fixes issue introduced in prior commit with formatting and handling -of parsing a root name response which should not be escaped. - -Fix By: Brad House ---- - ares_expand_name.c | 62 ++++++++++++++++++++++++++++++---------------- - 1 file changed, 40 insertions(+), 22 deletions(-) - -diff --git a/ares_expand_name.c b/ares_expand_name.c -index 8604543..f89ee3f 100644 ---- a/ares_expand_name.c -+++ b/ares_expand_name.c -@@ -133,27 +133,37 @@ int ares_expand_name(const unsigned char *encoded, const unsigned char *abuf, - } - else - { -- len = *p; -+ int name_len = *p; -+ len = name_len; - p++; -+ - while (len--) - { -- if (!isprint(*p)) { -- /* Output as \DDD for consistency with RFC1035 5.1 */ -- *q++ = '\\'; -- *q++ = '0' + *p / 100; -- *q++ = '0' + (*p % 100) / 10; -- *q++ = '0' + (*p % 10); -- } else if (is_reservedch(*p)) { -- *q++ = '\\'; -- *q++ = *p; -- } else { -- *q++ = *p; -- } -+ /* Output as \DDD for consistency with RFC1035 5.1, except -+ * for the special case of a root name response */ -+ if (!isprint(*p) && !(name_len == 1 && *p == 0)) -+ { -+ -+ *q++ = '\\'; -+ *q++ = '0' + *p / 100; -+ *q++ = '0' + (*p % 100) / 10; -+ *q++ = '0' + (*p % 10); -+ } -+ else if (is_reservedch(*p)) -+ { -+ *q++ = '\\'; -+ *q++ = *p; -+ } -+ else -+ { -+ *q++ = *p; -+ } - p++; - } - *q++ = '.'; - } -- } -+ } -+ - if (!indir) - *enclen = aresx_uztosl(p + 1U - encoded); - -@@ -200,21 +210,29 @@ static int name_length(const unsigned char *encoded, const unsigned char *abuf, - } - else if (top == 0x00) - { -- offset = *encoded; -+ int name_len = *encoded; -+ offset = name_len; - if (encoded + offset + 1 >= abuf + alen) - return -1; - encoded++; -+ - while (offset--) - { -- if (!isprint(*encoded)) { -- n += 4; -- } else if (is_reservedch(*encoded)) { -- n += 2; -- } else { -- n += 1; -- } -+ if (!isprint(*encoded) && !(name_len == 1 && *encoded == 0)) -+ { -+ n += 4; -+ } -+ else if (is_reservedch(*encoded)) -+ { -+ n += 2; -+ } -+ else -+ { -+ n += 1; -+ } - encoded++; - } -+ - n++; - } - else --- -2.26.3 - diff --git a/0003-Add-str-len-check-in-config_sortlist-to-avoid-stack-.patch b/0003-Add-str-len-check-in-config_sortlist-to-avoid-stack-.patch deleted file mode 100644 index ed2edf9..0000000 --- a/0003-Add-str-len-check-in-config_sortlist-to-avoid-stack-.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 9903253c347f9e0bffd285ae3829aef251cc852d Mon Sep 17 00:00:00 2001 -From: hopper-vul <118949689+hopper-vul@users.noreply.github.com> -Date: Wed, 18 Jan 2023 22:14:26 +0800 -Subject: [PATCH] Add str len check in config_sortlist to avoid stack overflow - (#497) - -In ares_set_sortlist, it calls config_sortlist(..., sortstr) to parse -the input str and initialize a sortlist configuration. - -However, ares_set_sortlist has not any checks about the validity of the input str. -It is very easy to create an arbitrary length stack overflow with the unchecked -`memcpy(ipbuf, str, q-str);` and `memcpy(ipbufpfx, str, q-str);` -statements in the config_sortlist call, which could potentially cause severe -security impact in practical programs. - -This commit add necessary check for `ipbuf` and `ipbufpfx` which avoid the -potential stack overflows. - -fixes #496 - -Fix By: @hopper-vul ---- - ares_init.c | 4 ++++ - test/ares-test-init.cc | 2 ++ - 2 files changed, 6 insertions(+) - -diff --git a/ares_init.c b/ares_init.c -index f7b700b..5aad7c8 100644 ---- a/ares_init.c -+++ b/ares_init.c -@@ -2065,6 +2065,8 @@ static int config_sortlist(struct apattern **sortlist, int *nsort, - q = str; - while (*q && *q != '/' && *q != ';' && !ISSPACE(*q)) - q++; -+ if (q-str >= 16) -+ return ARES_EBADSTR; - memcpy(ipbuf, str, q-str); - ipbuf[q-str] = '\0'; - /* Find the prefix */ -@@ -2073,6 +2075,8 @@ static int config_sortlist(struct apattern **sortlist, int *nsort, - const char *str2 = q+1; - while (*q && *q != ';' && !ISSPACE(*q)) - q++; -+ if (q-str >= 32) -+ return ARES_EBADSTR; - memcpy(ipbufpfx, str, q-str); - ipbufpfx[q-str] = '\0'; - str = str2; -diff --git a/test/ares-test-init.cc b/test/ares-test-init.cc -index 63c6a22..ee84518 100644 ---- a/test/ares-test-init.cc -+++ b/test/ares-test-init.cc -@@ -275,6 +275,8 @@ TEST_F(DefaultChannelTest, SetAddresses) { - - TEST_F(DefaultChannelTest, SetSortlistFailures) { - EXPECT_EQ(ARES_ENODATA, ares_set_sortlist(nullptr, "1.2.3.4")); -+ EXPECT_EQ(ARES_EBADSTR, ares_set_sortlist(channel_, "111.111.111.111*/16")); -+ EXPECT_EQ(ARES_EBADSTR, ares_set_sortlist(channel_, "111.111.111.111/255.255.255.240*")); - EXPECT_EQ(ARES_SUCCESS, ares_set_sortlist(channel_, "xyzzy ; lwk")); - EXPECT_EQ(ARES_SUCCESS, ares_set_sortlist(channel_, "xyzzy ; 0x123")); - } --- -2.37.3 - diff --git a/0004-Merge-pull-request-from-GHSA-9g78-jv2r-p7vc.patch b/0004-Merge-pull-request-from-GHSA-9g78-jv2r-p7vc.patch deleted file mode 100644 index 70f7e36..0000000 --- a/0004-Merge-pull-request-from-GHSA-9g78-jv2r-p7vc.patch +++ /dev/null @@ -1,82 +0,0 @@ -From b9b8413cfdb70a3f99e1573333b23052d57ec1ae Mon Sep 17 00:00:00 2001 -From: Brad House -Date: Mon, 22 May 2023 06:51:49 -0400 -Subject: [PATCH] Merge pull request from GHSA-9g78-jv2r-p7vc - ---- - ares_process.c | 41 +++++++++++++++++++++++++---------------- - 1 file changed, 25 insertions(+), 16 deletions(-) - -diff --git a/ares_process.c b/ares_process.c -index bf0cde4..6cac0a9 100644 ---- a/ares_process.c -+++ b/ares_process.c -@@ -470,7 +470,7 @@ static void read_udp_packets(ares_channel channel, fd_set *read_fds, - { - struct server_state *server; - int i; -- ares_ssize_t count; -+ ares_ssize_t read_len; - unsigned char buf[MAXENDSSZ + 1]; - #ifdef HAVE_RECVFROM - ares_socklen_t fromlen; -@@ -513,32 +513,41 @@ static void read_udp_packets(ares_channel channel, fd_set *read_fds, - /* To reduce event loop overhead, read and process as many - * packets as we can. */ - do { -- if (server->udp_socket == ARES_SOCKET_BAD) -- count = 0; -- -- else { -- if (server->addr.family == AF_INET) -+ if (server->udp_socket == ARES_SOCKET_BAD) { -+ read_len = -1; -+ } else { -+ if (server->addr.family == AF_INET) { - fromlen = sizeof(from.sa4); -- else -+ } else { - fromlen = sizeof(from.sa6); -- count = socket_recvfrom(channel, server->udp_socket, (void *)buf, -- sizeof(buf), 0, &from.sa, &fromlen); -+ } -+ read_len = socket_recvfrom(channel, server->udp_socket, (void *)buf, -+ sizeof(buf), 0, &from.sa, &fromlen); - } - -- if (count == -1 && try_again(SOCKERRNO)) -+ if (read_len == 0) { -+ /* UDP is connectionless, so result code of 0 is a 0-length UDP -+ * packet, and not an indication the connection is closed like on -+ * tcp */ - continue; -- else if (count <= 0) -+ } else if (read_len < 0) { -+ if (try_again(SOCKERRNO)) -+ continue; -+ - handle_error(channel, i, now); -+ - #ifdef HAVE_RECVFROM -- else if (!same_address(&from.sa, &server->addr)) -+ } else if (!same_address(&from.sa, &server->addr)) { - /* The address the response comes from does not match the address we - * sent the request to. Someone may be attempting to perform a cache - * poisoning attack. */ -- break; -+ continue; - #endif -- else -- process_answer(channel, buf, (int)count, i, 0, now); -- } while (count > 0); -+ -+ } else { -+ process_answer(channel, buf, (int)read_len, i, 0, now); -+ } -+ } while (read_len >= 0); - } - } - --- -2.38.1 - diff --git a/0005-avoid-read-heap-buffer-overflow-332.patch b/0005-avoid-read-heap-buffer-overflow-332.patch deleted file mode 100644 index 36d399f..0000000 --- a/0005-avoid-read-heap-buffer-overflow-332.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 65f83b8bf15a128524ef5fe26e1f1e219ee9b872 Mon Sep 17 00:00:00 2001 -From: Alexey Tikhonov -Date: Fri, 1 Sep 2023 20:00:12 +0200 -Subject: [PATCH] avoid read-heap-buffer-overflow (#332) - -Fix invalid read in ares_parse_soa_reply.c found during fuzzing - -Fixes Bug: #333 -Fix By: lutianxiong (@ltx2018) ---- - ares_parse_soa_reply.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/ares_parse_soa_reply.c b/ares_parse_soa_reply.c -index 35af0a7..5924bbc 100644 ---- a/ares_parse_soa_reply.c -+++ b/ares_parse_soa_reply.c -@@ -65,6 +65,9 @@ ares_parse_soa_reply(const unsigned char *abuf, int alen, - status = ares__expand_name_for_response(aptr, abuf, alen, &qname, &len); - if (status != ARES_SUCCESS) - goto failed_stat; -+ -+ if (alen <= len + HFIXEDSZ + 1) -+ goto failed; - aptr += len; - - /* skip qtype & qclass */ --- -2.38.1 - diff --git a/0006-Merge-pull-request-from-GHSA-x6mf-cxr9-8q6v.patch b/0006-Merge-pull-request-from-GHSA-x6mf-cxr9-8q6v.patch deleted file mode 100644 index 3877b9e..0000000 --- a/0006-Merge-pull-request-from-GHSA-x6mf-cxr9-8q6v.patch +++ /dev/null @@ -1,294 +0,0 @@ -From f22cc01039b6473b736d3bf438f56a2654cdf2b2 Mon Sep 17 00:00:00 2001 -From: Brad House -Date: Mon, 22 May 2023 06:51:34 -0400 -Subject: [PATCH] Merge pull request from GHSA-x6mf-cxr9-8q6v - -* Merged latest OpenBSD changes for inet_net_pton_ipv6() into c-ares. -* Always use our own IP conversion functions now, do not delegate to OS - so we can have consistency in testing and fuzzing. - -Fix By: Brad House (@bradh352) ---- - inet_net_pton.c | 155 ++++++++++++++++++++----------------- - -diff --git a/inet_net_pton.c b/inet_net_pton.c -index 840de50..fc50425 100644 ---- a/inet_net_pton.c -+++ b/inet_net_pton.c -@@ -1,19 +1,20 @@ - - /* -- * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC") -+ * Copyright (c) 2012 by Gilles Chehade - * Copyright (c) 1996,1999 by Internet Software Consortium. - * - * Permission to use, copy, modify, and distribute this software for any - * purpose with or without fee is hereby granted, provided that the above - * copyright notice and this permission notice appear in all copies. - * -- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES -- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF -- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR -- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES -- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN -- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT -- * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -+ * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS -+ * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES -+ * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE -+ * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL -+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR -+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS -+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS -+ * SOFTWARE. - */ - - #include "ares_setup.h" -@@ -35,9 +36,6 @@ - - const struct ares_in6_addr ares_in6addr_any = { { { 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 } } }; - -- --#ifndef HAVE_INET_NET_PTON -- - /* - * static int - * inet_net_pton_ipv4(src, dst, size) -@@ -60,7 +58,7 @@ const struct ares_in6_addr ares_in6addr_any = { { { 0,0,0,0,0,0,0,0,0,0,0,0,0,0, - * Paul Vixie (ISC), June 1996 - */ - static int --inet_net_pton_ipv4(const char *src, unsigned char *dst, size_t size) -+ares_inet_net_pton_ipv4(const char *src, unsigned char *dst, size_t size) - { - static const char xdigits[] = "0123456789abcdef"; - static const char digits[] = "0123456789"; -@@ -261,19 +259,14 @@ getv4(const char *src, unsigned char *dst, int *bitsp) - } - - static int --inet_net_pton_ipv6(const char *src, unsigned char *dst, size_t size) -+ares_inet_pton6(const char *src, unsigned char *dst) - { - static const char xdigits_l[] = "0123456789abcdef", -- xdigits_u[] = "0123456789ABCDEF"; -+ xdigits_u[] = "0123456789ABCDEF"; - unsigned char tmp[NS_IN6ADDRSZ], *tp, *endp, *colonp; - const char *xdigits, *curtok; -- int ch, saw_xdigit; -+ int ch, saw_xdigit, count_xdigit; - unsigned int val; -- int digits; -- int bits; -- size_t bytes; -- int words; -- int ipv4; - - memset((tp = tmp), '\0', NS_IN6ADDRSZ); - endp = tp + NS_IN6ADDRSZ; -@@ -283,22 +276,22 @@ inet_net_pton_ipv6(const char *src, unsigned char *dst, size_t size) - if (*++src != ':') - goto enoent; - curtok = src; -- saw_xdigit = 0; -+ saw_xdigit = count_xdigit = 0; - val = 0; -- digits = 0; -- bits = -1; -- ipv4 = 0; - while ((ch = *src++) != '\0') { - const char *pch; - - if ((pch = strchr((xdigits = xdigits_l), ch)) == NULL) - pch = strchr((xdigits = xdigits_u), ch); - if (pch != NULL) { -+ if (count_xdigit >= 4) -+ goto enoent; - val <<= 4; -- val |= aresx_sztoui(pch - xdigits); -- if (++digits > 4) -+ val |= (pch - xdigits); -+ if (val > 0xffff) - goto enoent; - saw_xdigit = 1; -+ count_xdigit++; - continue; - } - if (ch == ':') { -@@ -308,78 +301,107 @@ inet_net_pton_ipv6(const char *src, unsigned char *dst, size_t size) - goto enoent; - colonp = tp; - continue; -- } else if (*src == '\0') -+ } else if (*src == '\0') { - goto enoent; -+ } - if (tp + NS_INT16SZ > endp) -- return (0); -- *tp++ = (unsigned char)((val >> 8) & 0xff); -- *tp++ = (unsigned char)(val & 0xff); -+ goto enoent; -+ *tp++ = (unsigned char) (val >> 8) & 0xff; -+ *tp++ = (unsigned char) val & 0xff; - saw_xdigit = 0; -- digits = 0; -+ count_xdigit = 0; - val = 0; - continue; - } - if (ch == '.' && ((tp + NS_INADDRSZ) <= endp) && -- getv4(curtok, tp, &bits) > 0) { -- tp += NS_INADDRSZ; -+ ares_inet_net_pton_ipv4(curtok, tp, INADDRSZ) > 0) { -+ tp += INADDRSZ; - saw_xdigit = 0; -- ipv4 = 1; -+ count_xdigit = 0; - break; /* '\0' was seen by inet_pton4(). */ - } -- if (ch == '/' && getbits(src, &bits) > 0) -- break; - goto enoent; - } - if (saw_xdigit) { - if (tp + NS_INT16SZ > endp) - goto enoent; -- *tp++ = (unsigned char)((val >> 8) & 0xff); -- *tp++ = (unsigned char)(val & 0xff); -+ *tp++ = (unsigned char) (val >> 8) & 0xff; -+ *tp++ = (unsigned char) val & 0xff; - } -- if (bits == -1) -- bits = 128; -- -- words = (bits + 15) / 16; -- if (words < 2) -- words = 2; -- if (ipv4) -- words = 8; -- endp = tmp + 2 * words; -- - if (colonp != NULL) { - /* - * Since some memmove()'s erroneously fail to handle - * overlapping regions, we'll do the shift by hand. - */ -- const ares_ssize_t n = tp - colonp; -- ares_ssize_t i; -+ const int n = tp - colonp; -+ int i; - - if (tp == endp) - goto enoent; - for (i = 1; i <= n; i++) { -- *(endp - i) = *(colonp + n - i); -- *(colonp + n - i) = 0; -+ endp[- i] = colonp[n - i]; -+ colonp[n - i] = 0; - } - tp = endp; - } - if (tp != endp) - goto enoent; - -- bytes = (bits + 7) / 8; -- if (bytes > size) -- goto emsgsize; -- memcpy(dst, tmp, bytes); -- return (bits); -+ memcpy(dst, tmp, NS_IN6ADDRSZ); -+ return (1); - -- enoent: -+enoent: - SET_ERRNO(ENOENT); - return (-1); - -- emsgsize: -+emsgsize: - SET_ERRNO(EMSGSIZE); - return (-1); - } - -+static int -+ares_inet_net_pton_ipv6(const char *src, unsigned char *dst, size_t size) -+{ -+ struct ares_in6_addr in6; -+ int ret; -+ int bits; -+ size_t bytes; -+ char buf[INET6_ADDRSTRLEN + sizeof("/128")]; -+ char *sep; -+ const char *errstr; -+ -+ if (strlen(src) >= sizeof buf) { -+ SET_ERRNO(EMSGSIZE); -+ return (-1); -+ } -+ strncpy(buf, src, sizeof buf); -+ -+ sep = strchr(buf, '/'); -+ if (sep != NULL) -+ *sep++ = '\0'; -+ -+ ret = ares_inet_pton6(buf, (unsigned char *)&in6); -+ if (ret != 1) -+ return (-1); -+ -+ if (sep == NULL) -+ bits = 128; -+ else { -+ if (!getbits(sep, &bits)) { -+ SET_ERRNO(ENOENT); -+ return (-1); -+ } -+ } -+ -+ bytes = (bits + 7) / 8; -+ if (bytes > size) { -+ SET_ERRNO(EMSGSIZE); -+ return (-1); -+ } -+ memcpy(dst, &in6, bytes); -+ return (bits); -+} -+ - /* - * int - * inet_net_pton(af, src, dst, size) -@@ -403,18 +425,15 @@ ares_inet_net_pton(int af, const char *src, void *dst, size_t size) - { - switch (af) { - case AF_INET: -- return (inet_net_pton_ipv4(src, dst, size)); -+ return (ares_inet_net_pton_ipv4(src, dst, size)); - case AF_INET6: -- return (inet_net_pton_ipv6(src, dst, size)); -+ return (ares_inet_net_pton_ipv6(src, dst, size)); - default: - SET_ERRNO(EAFNOSUPPORT); - return (-1); - } - } - --#endif /* HAVE_INET_NET_PTON */ -- --#ifndef HAVE_INET_PTON - int ares_inet_pton(int af, const char *src, void *dst) - { - int result; -@@ -434,11 +453,3 @@ int ares_inet_pton(int af, const char *src, void *dst) - return 0; - return (result > -1 ? 1 : -1); - } --#else /* HAVE_INET_PTON */ --int ares_inet_pton(int af, const char *src, void *dst) --{ -- /* just relay this to the underlying function */ -- return inet_pton(af, src, dst); --} -- --#endif --- -2.41.0 - diff --git a/0007-Merge-pull-request-from-GHSA-mg26-v6qh-x48q.patch b/0007-Merge-pull-request-from-GHSA-mg26-v6qh-x48q.patch deleted file mode 100644 index 5cb4b50..0000000 --- a/0007-Merge-pull-request-from-GHSA-mg26-v6qh-x48q.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 5fdda1a5891f8828075225975fbdef1d3e87fb57 Mon Sep 17 00:00:00 2001 -From: Alexey Tikhonov -Date: Mon, 11 Mar 2024 20:46:09 +0100 -Subject: [PATCH] Merge pull request from GHSA-mg26-v6qh-x48q - -Backported from -https://github.com/c-ares/c-ares/commit/a804c04ddc8245fc8adf0e92368709639125e183 ---- - ares__read_line.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/ares__read_line.c b/ares__read_line.c -index c62ad2a..d6625a3 100644 ---- a/ares__read_line.c -+++ b/ares__read_line.c -@@ -49,6 +49,14 @@ int ares__read_line(FILE *fp, char **buf, size_t *bufsize) - if (!fgets(*buf + offset, bytestoread, fp)) - return (offset != 0) ? 0 : (ferror(fp)) ? ARES_EFILE : ARES_EOF; - len = offset + strlen(*buf + offset); -+ -+ /* Probably means there was an embedded NULL as the first character in -+ * the line, throw away line */ -+ if (len == 0) { -+ offset = 0; -+ continue; -+ } -+ - if ((*buf)[len - 1] == '\n') - { - (*buf)[len - 1] = 0; --- -2.42.0 - diff --git a/LICENSE b/LICENSE deleted file mode 100644 index 4c1423a..0000000 --- a/LICENSE +++ /dev/null @@ -1,12 +0,0 @@ -Copyright (C) 2004 by Daniel Stenberg et al - -Permission to use, copy, modify, and distribute this software and its -documentation for any purpose and without fee is hereby granted, provided -that the above copyright notice appear in all copies and that both that -copyright notice and this permission notice appear in supporting -documentation, and that the name of M.I.T. not be used in advertising or -publicity pertaining to distribution of the software without specific, -written prior permission. M.I.T. makes no representations about the -suitability of this software for any purpose. It is provided "as is" -without express or implied warranty. - diff --git a/c-ares-1.34.6-CVE-2026-33630.patch b/c-ares-1.34.6-CVE-2026-33630.patch new file mode 100644 index 0000000..587ec02 --- /dev/null +++ b/c-ares-1.34.6-CVE-2026-33630.patch @@ -0,0 +1,472 @@ +From f1134474ed2b19374556515d6fdd33aae4250125 Mon Sep 17 00:00:00 2001 +From: Brad House +Date: Mon, 6 Jul 2026 11:19:36 -0400 +Subject: [PATCH] [Backport v1.34] Fix double-free in process_timeouts() and + consolidate requeue handling (#1237) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Backports the double-free fix (**GHSA-6wfj-rwm7-3542** / +**CVE-2026-33630**) and the requeue-recursion fix for #1043 to the +`v1.34` release branch. + +Cherry-pick of main commit 1fa3b86a0b8d18fe7b60f3228a01d770feb026bc — +applied cleanly (diff identical to main; v1.34 already carried the +`requeue`-array infrastructure from the earlier security merge, so this +adds the `ares_flush_requeue()` / `ares_send_query_int()` consolidation +on top). + +## What it fixes +- **Double-free (self-cancellation):** `process_timeouts()` invoked the +query callback without first detaching the query from `queries_by_qid` / +`all_queries`, so a reentrant `ares_cancel()` from the callback freed +the query which was then freed again by the caller. The same +self-cancellation double-free was also reachable via `read_answers()`' +deferred ENDQUERY flush. +- **#1043 stack overflow:** unbounded `ares_requeue_query()` → +`ares_send_query()` recursion. + +Both share one root cause — deferred work being done immediately. Every +flush site now funnels through `ares_flush_requeue()`, which +re-dispatches retries iteratively and fully detaches each query before +invoking its callback. + +## Verification +- CMake + Ninja Debug build clean, no warnings in `ares_process.c`. +- Regression tests pass, including `CancelInCallbackNoDoubleFree` and +`NoSocketExplosionOnTimeout` (91 targeted cancel/timeout tests green). + +Target release: **1.34.7**. +--- + src/lib/ares_process.c | 185 ++++++++++++++++++++++++++++++----------- + test/ares-test-mock.cc | 111 +++++++++++++++++++++++++ + 2 files changed, 248 insertions(+), 48 deletions(-) + +diff --git a/src/lib/ares_process.c b/src/lib/ares_process.c +index 93529684..cafc05bd 100644 +--- a/src/lib/ares_process.c ++++ b/src/lib/ares_process.c +@@ -66,6 +66,11 @@ static void end_query(ares_channel_t *channel, ares_server_t *server, + ares_query_t *query, ares_status_t status, + ares_dns_record_t *dnsrec, + ares_array_t **requeue); ++static ares_status_t ares_send_query_int(ares_server_t *requested_server, ++ ares_query_t *query, ++ const ares_timeval_t *now, ++ ares_array_t **requeue); ++static void ares_detach_query(ares_query_t *query); + + static void ares_query_remove_from_conn(ares_query_t *query) + { +@@ -573,6 +578,79 @@ static ares_status_t ares_append_endqueue(ares_array_t **requeue, + dnsrec); + } + ++/* Drain the deferred requeue/endqueue list iteratively. All flush sites ++ * (read_answers(), process_timeouts(), and ares_send_query()) funnel through ++ * here so that: ++ * 1. Retries are re-dispatched by appending to this same list and looping, ++ * rather than recursing ares_requeue_query() -> ares_send_query() until ++ * the stack is exhausted (issue #1043). ++ * 2. A query is fully detached from all lookup lists before its callback is ++ * invoked, so a reentrant ares_cancel() from within that callback cannot ++ * find and free the same query, which would otherwise double-free it ++ * (CVE-2026-33630 / GHSA-6wfj-rwm7-3542). ++ * ++ * On return the list has been fully processed, an empty-queue notification has ++ * been sent if appropriate, and *requeue has been destroyed and set to NULL. */ ++static ares_status_t ares_flush_requeue(ares_channel_t *channel, ++ const ares_timeval_t *now, ++ ares_array_t **requeue) ++{ ++ ares_status_t status = ARES_SUCCESS; ++ ++ if (requeue == NULL) { ++ return status; ++ } ++ ++ while (*requeue != NULL && ares_array_len(*requeue) > 0) { ++ ares_query_t *query; ++ ares_requeue_t entry; ++ ares_status_t internal_status; ++ ++ internal_status = ares_array_claim_at(&entry, sizeof(entry), *requeue, 0); ++ if (internal_status != ARES_SUCCESS) { ++ break; /* LCOV_EXCL_LINE: DefensiveCoding */ ++ } ++ ++ query = ares_htable_szvp_get_direct(channel->queries_by_qid, entry.qid); ++ ++ if (entry.type == REQUEUE_REQUEUE) { ++ /* Query disappeared (e.g. a prior callback in this drain cancelled it) */ ++ if (query == NULL) { ++ continue; ++ } ++ /* Re-dispatch via the internal entrypoint so any further requeues are ++ * appended back onto this same list and drained by the loop above, ++ * rather than recursing. */ ++ internal_status = ares_send_query_int(entry.server, query, now, requeue); ++ /* We only care about ARES_ENOMEM */ ++ if (internal_status == ARES_ENOMEM) { ++ status = ARES_ENOMEM; ++ } ++ } else { /* REQUEUE_ENDQUERY */ ++ if (query != NULL) { ++ /* Detach the query from all lookup lists BEFORE invoking the callback. ++ * Otherwise a reentrant ares_cancel() from within the callback would ++ * find this query still linked in all_queries/queries_by_qid, free it, ++ * and the ares_free_query() below would then double-free it. */ ++ ares_detach_query(query); ++ query->callback(query->arg, entry.status, query->timeouts, ++ entry.dnsrec); ++ ares_free_query(query); ++ } ++ ares_dns_record_destroy(entry.dnsrec); ++ } ++ } ++ ++ /* Don't forget to send notification if queue emptied */ ++ if (*requeue != NULL) { ++ ares_queue_notify_empty(channel); ++ } ++ ares_array_destroy(*requeue); ++ *requeue = NULL; ++ ++ return status; ++} ++ + static ares_status_t read_answers(ares_conn_t *conn, const ares_timeval_t *now) + { + ares_status_t status; +@@ -625,43 +703,11 @@ static ares_status_t read_answers(ares_conn_t *conn, const ares_timeval_t *now) + } + + cleanup: +- +- /* Flush requeue */ +- while (ares_array_len(requeue) > 0) { +- ares_query_t *query; +- ares_requeue_t entry; +- ares_status_t internal_status; +- +- internal_status = ares_array_claim_at(&entry, sizeof(entry), requeue, 0); +- if (internal_status != ARES_SUCCESS) { +- break; +- } +- +- query = ares_htable_szvp_get_direct(channel->queries_by_qid, entry.qid); +- +- if (entry.type == REQUEUE_REQUEUE) { +- /* query disappeared */ +- if (query == NULL) { +- continue; +- } +- internal_status = ares_send_query(entry.server, query, now); +- /* We only care about ARES_ENOMEM */ +- if (internal_status == ARES_ENOMEM) { +- status = ARES_ENOMEM; +- } +- } else { /* REQUEUE_ENDQUERY */ +- if (query != NULL) { +- query->callback(query->arg, entry.status, query->timeouts, entry.dnsrec); +- ares_free_query(query); +- } +- ares_dns_record_destroy(entry.dnsrec); +- } +- } +- /* Don't forget to send notification if queue emptied */ +- if (requeue != NULL) { +- ares_queue_notify_empty(channel); ++ /* Flush requeue - re-dispatch retries and invoke deferred callbacks ++ * iteratively and safely */ ++ if (ares_flush_requeue(channel, now, &requeue) == ARES_ENOMEM) { ++ status = ARES_ENOMEM; + } +- ares_array_destroy(requeue); + + return status; + } +@@ -696,7 +742,8 @@ static ares_status_t process_timeouts(ares_channel_t *channel, + const ares_timeval_t *now) + { + ares_slist_node_t *node; +- ares_status_t status = ARES_SUCCESS; ++ ares_status_t status = ARES_SUCCESS; ++ ares_array_t *requeue = NULL; + + /* Just keep popping off the first as this list will re-sort as things come + * and go. We don't want to try to rely on 'next' as some operation might +@@ -715,13 +762,19 @@ static ares_status_t process_timeouts(ares_channel_t *channel, + + conn = query->conn; + server_increment_failures(conn->server, query->using_tcp); +- status = ares_requeue_query(query, now, ARES_ETIMEOUT, ARES_TRUE, NULL, +- NULL); ++ status = ++ ares_requeue_query(query, now, ARES_ETIMEOUT, ARES_TRUE, NULL, &requeue); + if (status == ARES_ENOMEM) { + goto done; + } + } + done: ++ /* Flush requeue - re-dispatch retries and invoke deferred callbacks ++ * iteratively and safely */ ++ if (ares_flush_requeue(channel, now, &requeue) == ARES_ENOMEM) { ++ status = ARES_ENOMEM; ++ } ++ + if (status == ARES_ENOMEM) { + return ARES_ENOMEM; + } +@@ -871,7 +924,7 @@ static ares_status_t process_answer(ares_channel_t *channel, + if (issue_might_be_edns(query->query, rdnsrec)) { + status = rewrite_without_edns(query); + if (status != ARES_SUCCESS) { +- end_query(channel, server, query, status, NULL, NULL); ++ end_query(channel, server, query, status, NULL, requeue); + goto cleanup; + } + +@@ -1262,8 +1315,44 @@ static ares_status_t ares_conn_query_write(ares_conn_t *conn, + return ares_conn_flush(conn); + } + ++/* Public entrypoint. Establishes a requeue list and drives ++ * ares_send_query_int() plus any retries/deferred callbacks it produces ++ * iteratively, so a chain of retryable failures can never recurse until the ++ * stack is exhausted (#1043). */ + ares_status_t ares_send_query(ares_server_t *requested_server, + ares_query_t *query, const ares_timeval_t *now) ++{ ++ ares_channel_t *channel = query->channel; ++ ares_array_t *requeue = NULL; ++ unsigned short qid = query->qid; ++ ares_status_t status; ++ ++ status = ares_send_query_int(requested_server, query, now, &requeue); ++ ++ /* Drain any retries/deferred callbacks this send produced. ++ * ares_flush_requeue() always fully processes and destroys the list (even on ++ * ENOMEM), and sends the empty-queue notification if needed. */ ++ if (ares_flush_requeue(channel, now, &requeue) == ARES_ENOMEM) { ++ status = ARES_ENOMEM; ++ } ++ ++ /* A retry may have been deferred (returning ARES_SUCCESS from the append) ++ * and then terminally failed while draining, in which case the query has ++ * been freed. Do not dereference 'query' here. If it is no longer tracked ++ * it ended, so don't report success to the caller (which would, e.g., cause ++ * ares_send_nolock() to write to a now-freed *qid). */ ++ if (status == ARES_SUCCESS && ++ ares_htable_szvp_get_direct(channel->queries_by_qid, qid) == NULL) { ++ status = ARES_ETIMEOUT; ++ } ++ ++ return status; ++} ++ ++static ares_status_t ares_send_query_int(ares_server_t *requested_server, ++ ares_query_t *query, ++ const ares_timeval_t *now, ++ ares_array_t **requeue) + { + ares_channel_t *channel = query->channel; + ares_server_t *server; +@@ -1286,7 +1375,7 @@ ares_status_t ares_send_query(ares_server_t *requested_server, + } + + if (server == NULL) { +- end_query(channel, server, query, ARES_ENOSERVER /* ? */, NULL, NULL); ++ end_query(channel, server, query, ARES_ENOSERVER /* ? */, NULL, requeue); + return ARES_ENOSERVER; + } + +@@ -1310,11 +1399,11 @@ ares_status_t ares_send_query(ares_server_t *requested_server, + case ARES_ECONNREFUSED: + case ARES_EBADFAMILY: + server_increment_failures(server, query->using_tcp); +- return ares_requeue_query(query, now, status, ARES_TRUE, NULL, NULL); ++ return ares_requeue_query(query, now, status, ARES_TRUE, NULL, requeue); + + /* Anything else is not retryable, likely ENOMEM */ + default: +- end_query(channel, server, query, status, NULL, NULL); ++ end_query(channel, server, query, status, NULL, requeue); + return status; + } + } +@@ -1328,7 +1417,7 @@ ares_status_t ares_send_query(ares_server_t *requested_server, + + case ARES_ENOMEM: + /* Not retryable */ +- end_query(channel, server, query, status, NULL, NULL); ++ end_query(channel, server, query, status, NULL, requeue); + return status; + + /* These conditions are retryable as they are server-specific +@@ -1336,7 +1425,7 @@ ares_status_t ares_send_query(ares_server_t *requested_server, + case ARES_ECONNREFUSED: + case ARES_EBADFAMILY: + handle_conn_error(conn, ARES_TRUE, status); +- status = ares_requeue_query(query, now, status, ARES_TRUE, NULL, NULL); ++ status = ares_requeue_query(query, now, status, ARES_TRUE, NULL, requeue); + if (status == ARES_ETIMEOUT) { + status = ARES_ECONNREFUSED; + } +@@ -1344,7 +1433,7 @@ ares_status_t ares_send_query(ares_server_t *requested_server, + + default: + server_increment_failures(server, query->using_tcp); +- status = ares_requeue_query(query, now, status, ARES_TRUE, NULL, NULL); ++ status = ares_requeue_query(query, now, status, ARES_TRUE, NULL, requeue); + return status; + } + +@@ -1360,7 +1449,7 @@ ares_status_t ares_send_query(ares_server_t *requested_server, + ares_slist_insert(channel->queries_by_timeout, query); + if (!query->node_queries_by_timeout) { + /* LCOV_EXCL_START: OutOfMemory */ +- end_query(channel, server, query, ARES_ENOMEM, NULL, NULL); ++ end_query(channel, server, query, ARES_ENOMEM, NULL, requeue); + return ARES_ENOMEM; + /* LCOV_EXCL_STOP */ + } +@@ -1373,7 +1462,7 @@ ares_status_t ares_send_query(ares_server_t *requested_server, + + if (query->node_queries_to_conn == NULL) { + /* LCOV_EXCL_START: OutOfMemory */ +- end_query(channel, server, query, ARES_ENOMEM, NULL, NULL); ++ end_query(channel, server, query, ARES_ENOMEM, NULL, requeue); + return ARES_ENOMEM; + /* LCOV_EXCL_STOP */ + } +diff --git a/test/ares-test-mock.cc b/test/ares-test-mock.cc +index 4b60eee8..35789e17 100644 +--- a/test/ares-test-mock.cc ++++ b/test/ares-test-mock.cc +@@ -1722,6 +1722,115 @@ TEST_P(MockUDPChannelTest, TriggerResendThenConnFailEDNS) { + EXPECT_EQ("{'www.google.com' aliases=[] addrs=[1.2.3.4]}", ss.str()); + } + ++// Regression for issue #1043: a long chain of retryable connection failures ++// used to recurse ares_requeue_query() -> ares_send_query() until the stack was ++// exhausted. With a very high retry count and a socket that always fails to be ++// created (a retryable ARES_ECONNREFUSED), the retries must be processed ++// iteratively and the query must terminate cleanly rather than crashing. ++class MockRetryDepthChannelTest : public MockChannelOptsTest, ++ public ::testing::WithParamInterface { ++public: ++ MockRetryDepthChannelTest() ++ : MockChannelOptsTest(1, GetParam(), false, false, FillOptions(&opts_), ++ ARES_OPT_TRIES) ++ { ++ } ++ ++ static struct ares_options *FillOptions(struct ares_options *opts) ++ { ++ memset(opts, 0, sizeof(struct ares_options)); ++ /* Large enough that the old recursive path would overflow the stack. */ ++ opts->tries = 100000; ++ return opts; ++ } ++ ++private: ++ struct ares_options opts_; ++}; ++ ++static size_t g_always_fail_socket_calls = 0; ++ ++static ares_socket_t always_fail_socket(int af, int type, int protocol, ++ void *user_data) ++{ ++ (void)af; ++ (void)type; ++ (void)protocol; ++ (void)user_data; ++ g_always_fail_socket_calls++; ++ return ARES_SOCKET_BAD; ++} ++ ++TEST_P(MockRetryDepthChannelTest, HighRetryNoStackOverflow) { ++ ares_socket_functions sock_funcs; ++ memset(&sock_funcs, 0, sizeof(sock_funcs)); ++ sock_funcs.asocket = always_fail_socket; ++ ares_set_socket_functions(channel_, &sock_funcs, NULL); ++ ++ g_always_fail_socket_calls = 0; ++ ++ QueryResult result; ++ ares_query_dnsrec(channel_, "www.google.com", ARES_CLASS_IN, ARES_REC_TYPE_A, ++ QueryCallback, &result, NULL); ++ Process(); ++ ++ /* If the retries didn't drive the query to a terminal state on their own ++ * (e.g. it parked awaiting a response that will never arrive), cancel it so ++ * the query terminates deterministically. */ ++ if (!result.done_) { ++ ares_cancel(channel_); ++ Process(); ++ } ++ ++ /* The essential property is that we reached this point at all: on unpatched ++ * code the retryable failures recursed ares_requeue_query()/ares_send_query() ++ * until the stack overflowed and the process aborted before getting here. We ++ * also confirm the retries were attempted iteratively (more than one socket ++ * creation) and that the query reached a terminal state. */ ++ EXPECT_GT(g_always_fail_socket_calls, (size_t)1); ++ EXPECT_TRUE(result.done_); ++} ++ ++// Regression for CVE-2026-33630 / GHSA-6wfj-rwm7-3542: invoking ares_cancel() ++// from within a normal response callback must not double-free the query. The ++// callback is dispatched from the read_answers() deferred-requeue flush, and the ++// query must be detached from all lookup lists before the callback runs so that ++// the reentrant ares_cancel() cannot find and free it a second time. ++struct CancelInCbData { ++ ares_channel_t *channel; ++ bool done; ++}; ++ ++static void CancelChannelCallback(void *arg, ares_status_t status, ++ size_t timeouts, ++ const ares_dns_record_t *dnsrec) ++{ ++ CancelInCbData *data = static_cast(arg); ++ (void)status; ++ (void)timeouts; ++ (void)dnsrec; ++ data->done = true; ++ /* Reentrant cancel from within the callback. Must not double-free. */ ++ ares_cancel(data->channel); ++} ++ ++TEST_P(MockUDPChannelTest, CancelInCallbackNoDoubleFree) { ++ DNSPacket reply; ++ reply.set_response().set_aa() ++ .add_question(new DNSQuestion("www.google.com", T_A)) ++ .add_answer(new DNSARR("www.google.com", 0x0100, {0x01, 0x02, 0x03, 0x04})); ++ ON_CALL(server_, OnRequest("www.google.com", T_A)) ++ .WillByDefault(SetReply(&server_, &reply)); ++ ++ CancelInCbData data; ++ data.channel = channel_; ++ data.done = false; ++ ares_query_dnsrec(channel_, "www.google.com", ARES_CLASS_IN, ARES_REC_TYPE_A, ++ CancelChannelCallback, &data, NULL); ++ Process(); ++ EXPECT_TRUE(data.done); ++} ++ + TEST_P(MockUDPChannelTest, GetSock) { + DNSPacket reply; + reply.set_response().set_aa() +@@ -2573,6 +2682,8 @@ INSTANTIATE_TEST_SUITE_P(AddressFamilies, ContainedMockChannelSysConfig, ::testi + + INSTANTIATE_TEST_SUITE_P(AddressFamilies, MockUDPChannelTest, ::testing::ValuesIn(ares::test::families), PrintFamily); + ++INSTANTIATE_TEST_SUITE_P(AddressFamilies, MockRetryDepthChannelTest, ::testing::ValuesIn(ares::test::families), PrintFamily); ++ + INSTANTIATE_TEST_SUITE_P(AddressFamilies, MockUDPMaxQueriesTest, ::testing::ValuesIn(ares::test::families), PrintFamily); + + INSTANTIATE_TEST_SUITE_P(AddressFamilies, CacheQueriesTest, ::testing::ValuesIn(ares::test::families), PrintFamily); diff --git a/c-ares.spec b/c-ares.spec index 95c4174..7c28c7d 100644 --- a/c-ares.spec +++ b/c-ares.spec @@ -1,109 +1,186 @@ +%global use_cmake 1 + Summary: A library that performs asynchronous DNS operations Name: c-ares -Version: 1.13.0 -Release: 11%{?dist} +Version: 1.34.6 +Release: 2%{?dist} License: MIT -Group: System Environment/Libraries -URL: http://c-ares.haxx.se/ -Source0: http://c-ares.haxx.se/download/%{name}-%{version}.tar.gz -# The license can be obtained at http://c-ares.haxx.se/license.html -Source1: LICENSE -Patch0: 0001-Use-RPM-compiler-options.patch -Patch1: 0002-fix-CVE-2021-3672.patch -Patch2: 0003-Add-str-len-check-in-config_sortlist-to-avoid-stack-.patch -Patch3: 0004-Merge-pull-request-from-GHSA-9g78-jv2r-p7vc.patch -Patch4: 0005-avoid-read-heap-buffer-overflow-332.patch -Patch5: 0006-Merge-pull-request-from-GHSA-x6mf-cxr9-8q6v.patch -Patch6: 0007-Merge-pull-request-from-GHSA-mg26-v6qh-x48q.patch - -BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) - +URL: http://c-ares.org/ +Source0: https://github.com/c-ares/c-ares/releases/download/v%{version}/c-ares-%{version}.tar.gz +#Patch0: 0001-Merge-pull-request-from-GHSA-mg26-v6qh-x48q.patch +# https://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a +Patch1: c-ares-1.34.6-CVE-2026-33630.patch +BuildRequires: gcc +%if %{use_cmake} +BuildRequires: cmake +%else BuildRequires: autoconf BuildRequires: automake BuildRequires: libtool +%endif +BuildRequires: make %description -c-ares is a C library that performs DNS requests and name resolves -asynchronously. c-ares is a fork of the library named 'ares', written +c-ares is a C library that performs DNS requests and name resolves +asynchronously. c-ares is a fork of the library named 'ares', written by Greg Hudson at MIT. %package devel Summary: Development files for c-ares -Group: Development/Libraries -Requires: %{name} = %{version}-%{release} -Requires: pkgconfig +Requires: %{name}%{?_isa} = %{version}-%{release} %description devel This package contains the header files and libraries needed to compile applications or shared objects that use c-ares. %prep -%setup -q -%patch0 -p1 -b .optflags -%patch1 -p1 -b .dns -%patch2 -p1 -b .sortlist -%patch3 -p1 -b .udp -%patch4 -p1 -b .buffer -%patch5 -p1 -b .underwrite -%patch6 -p1 -b .bounds - -cp %{SOURCE1} . -f=CHANGES ; iconv -f iso-8859-1 -t utf-8 $f -o $f.utf8 ; mv $f.utf8 $f +%autosetup -p1 %build +# autoreconf -if +# %%configure --enable-shared --disable-static \ +# --disable-dependency-tracking +%if %{use_cmake} +%{cmake} -DCARES_BUILD_TOOLS:BOOL=OFF +%cmake_build +%else autoreconf -if %configure --enable-shared --disable-static \ --disable-dependency-tracking %{__make} %{?_smp_mflags} +%endif %install -rm -rf $RPM_BUILD_ROOT -make DESTDIR=$RPM_BUILD_ROOT install +%if %{use_cmake} +%cmake_install +%else +%make_install rm -f $RPM_BUILD_ROOT/%{_libdir}/libcares.la +%endif -%clean -rm -rf $RPM_BUILD_ROOT - -%post -p /sbin/ldconfig -%postun -p /sbin/ldconfig +%ldconfig_scriptlets %files -%defattr(-, root, root) -%doc README.cares CHANGES NEWS LICENSE +%license LICENSE.md +%doc README.md RELEASE-NOTES.md %{_libdir}/*.so.* %files devel -%defattr(-, root, root, 0755) %{_includedir}/ares.h %{_includedir}/ares_build.h %{_includedir}/ares_dns.h -%{_includedir}/ares_rules.h +%{_includedir}/ares_dns_record.h +%{_includedir}/ares_nameser.h +# %%{_includedir}/ares_rules.h %{_includedir}/ares_version.h %{_libdir}/*.so +%if %{use_cmake} +%{_libdir}/cmake/c-ares/ +%endif %{_libdir}/pkgconfig/libcares.pc %{_mandir}/man3/ares_* %changelog -* Tue Mar 12 2024 Alexey Tikhonov - 1.13.0-11 -- Resolves: RHEL-26525 - c-ares: Out of bounds read in ares__read_line() [rhel-8] +* Fri Jul 10 2026 RHEL Packaging Agent - 1.34.6-2 +- Fix double-free in process_timeouts() (CVE-2026-33630) + Resolves: RHEL-192867 -* Wed Oct 4 2023 Alexey Tikhonov - 1.13.0-10 -- Resolves: RHEL-7853 - Buffer Underwrite in ares_inet_net_pton() [rhel-8] +* Tue Dec 09 2025 Alejandro López - 1.34.6-1 +- Update to 1.34.6 + Resolves: RHEL-103761 -* Fri Sep 8 2023 Alexey Tikhonov - 1.13.0-9 -- Resolves: rhbz#2235805 - read-heap-buffer-overflow in ares_parse_soa_reply [rhel-8] +* Tue Oct 29 2024 Troy Dawson - 1.25.0-6 +- Bump release for October 2024 mass rebuild: + Resolves: RHEL-64018 -* Mon May 29 2023 Alexey Tikhonov - 1.13.0-8 -- Resolves: rhbz#2209517 - CVE-2023-32067 c-ares: 0-byte UDP payload Denial of Service [rhel-8.9.0] +* Mon Jun 24 2024 Troy Dawson - 1.25.0-5 +- Bump release for June 2024 mass rebuild -* Fri May 12 2023 Alexey Tikhonov - 1.13.0-7 -- Resolves: rhbz#2170867 - c-ares: buffer overflow in config_sortlist() due to missing string length check [rhel-8] +* Tue Mar 26 2024 Alexey Tikhonov - 1.25.0-4 +- Resolves: RHEL-30025 - Out of bounds read in ares__read_line() [rhel-10.0] -* Fri Oct 15 2021 Alexey Tikhonov - 1.13.0-6 -- Resolves: rhbz#1989425 - CVE-2021-3672 c-ares: missing input validation of host names may lead to Domain Hijacking [rhel-8] +* Tue Jan 23 2024 Fedora Release Engineering - 1.25.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild -* Mon Aug 13 2018 Jakub Hrozek - 1.13.0-5 -- Drop an unused patch +* Fri Jan 19 2024 Fedora Release Engineering - 1.25.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Wed Jan 10 2024 Tom Callaway - 1.25.0-1 +- update to 1.25.0 + +* Tue Nov 21 2023 Tom Callaway - 1.22.1-1 +- update to 1.22.1 + +* Sun Nov 5 2023 Tom Callaway - 1.21.0-1 +- update to 1.21.0 + +* Wed May 24 2023 Tom Callaway - 1.19.1-1 +- update to 1.19.1 +- fixes CVE-2023-32067 + +* Fri Feb 17 2023 Tom Callaway - 1.19.0-1 +- update to 1.19.0 +- fixes CVE-2022-4904 + +* Wed Jan 18 2023 Fedora Release Engineering - 1.17.2-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Wed Jul 20 2022 Fedora Release Engineering - 1.17.2-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Wed Jan 19 2022 Fedora Release Engineering - 1.17.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Mon Aug 16 2021 Tom Callaway - 1.17.2-1 +- update to 1.17.2 +- fixes multiple security issues including CVE-2021-3672 + +* Wed Jul 21 2021 Fedora Release Engineering - 1.17.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Tue Jan 26 2021 Fedora Release Engineering - 1.17.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Fri Nov 20 2020 Tom Callaway - 1.17.1-1 +- update to 1.17.1 + +* Tue Nov 17 2020 Tom Callaway - 1.17.0-1 +- update to 1.17.0 + +* Mon Jul 27 2020 Fedora Release Engineering - 1.16.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Mon Jul 13 2020 Tom Stellard - 1.16.1-2 +- Use make macros +- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro + +* Mon May 11 2020 Tom Callaway - 1.16.1-1 +- update to 1.16.1 + +* Fri Mar 13 2020 Tom Callaway - 1.16.0-1 +- update to 1.16.0 + +* Tue Jan 28 2020 Fedora Release Engineering - 1.15.0-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Wed Jul 24 2019 Fedora Release Engineering - 1.15.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Tue Mar 12 2019 Tom Callaway - 1.15.0-3 +- use cmake to build so we get cmake helpers (bz1687844) + +* Thu Jan 31 2019 Fedora Release Engineering - 1.15.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Tue Nov 13 2018 Jakub Hrozek - 1.16.0-1 +- Update to the latest upstream + +* Mon Sep 3 2018 Jakub Hrozek - 1.14.0-1 +- Update to the latest upstream +- Resolves: rhbz#1624499 - RFE: New c-ares release 1.14.0 available + +* Thu Jul 12 2018 Fedora Release Engineering - 1.13.0-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild * Wed Feb 07 2018 Fedora Release Engineering - 1.13.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild diff --git a/gating.yaml b/gating.yaml deleted file mode 100644 index 2e0e0fc..0000000 --- a/gating.yaml +++ /dev/null @@ -1,7 +0,0 @@ -# recipients: sssd-qe ---- !Policy -product_versions: - - rhel-8 -decision_context: osci_compose_gate -rules: - - !PassingTestCaseRule {test_case_name: idm-ci.brew-build.tier0.revdep} diff --git a/sources b/sources index 0fa3384..8681ea7 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (c-ares-1.13.0.tar.gz) = 4a7942e754673f5b8d55a7471e31b0f390e8324b14c12077580c956147fad4d165c7fe8a3190199b1add95c710ceeb1a7957706d4f0d6299d39c5dddc719bd9d +SHA512 (c-ares-1.34.6.tar.gz) = 826eecdb40942caf75da982b9ca57fbe7c3e7c23af43a908683c7c1523c46b06ebac68405c26db8bf4c8b0774ca415666866249a3bde663a71c278f4ec7b1827