import UBI c-ares-1.34.6-2.el10_2

2026-07-20 19:02:12 -04:00
13 changed files with 609 additions and 822 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,2 +1 @@
-SOURCES/c-ares-1.13.0.tar.gz
+c-ares-1.34.6.tar.gz
 /c-ares-1.13.0.tar.gz
--- a/0001-Use-RPM-compiler-options.patch
+++ b/0001-Use-RPM-compiler-options.patch
@ -1,41 +0,0 @@
 From 7dada62a77e061c752123e672e844386ff3b01ea Mon Sep 17 00:00:00 2001
 From: Stephen Gallagher <sgallagh@redhat.com>
 Date: Wed, 10 Apr 2013 12:32:44 -0400
 Subject: [PATCH] Use RPM compiler options
 ---
 m4/cares-compilers.m4 | 19 ++++++-------------
 1 file changed, 6 insertions(+), 13 deletions(-)
 diff --git a/m4/cares-compilers.m4 b/m4/cares-compilers.m4
 index 7ee8e0dbe741c1a64149a0d20b826f507b3ec620..d7708230fb5628ae80fbf1052da0d2c78ebbc160 100644
 --- a/m4/cares-compilers.m4
 +++ b/m4/cares-compilers.m4
@@ -143,19 +143,12 @@ AC_DEFUN([CARES_CHECK_COMPILER_GNU_C], [
     gccvhi=`echo $gccver | cut -d . -f1`
     gccvlo=`echo $gccver | cut -d . -f2`
     compiler_num=`(expr $gccvhi "*" 100 + $gccvlo) 2>/dev/null`
 -    flags_dbg_all="-g -g0 -g1 -g2 -g3"
 -    flags_dbg_all="$flags_dbg_all -ggdb"
 -    flags_dbg_all="$flags_dbg_all -gstabs"
 -    flags_dbg_all="$flags_dbg_all -gstabs+"
 -    flags_dbg_all="$flags_dbg_all -gcoff"
 -    flags_dbg_all="$flags_dbg_all -gxcoff"
 -    flags_dbg_all="$flags_dbg_all -gdwarf-2"
 -    flags_dbg_all="$flags_dbg_all -gvms"
 -    flags_dbg_yes="-g"
 -    flags_dbg_off="-g0"
 -    flags_opt_all="-O -O0 -O1 -O2 -O3 -Os"
 -    flags_opt_yes="-O2"
 -    flags_opt_off="-O0"
 +    flags_dbg_all=""
 +    flags_dbg_yes=""
 +    flags_dbg_off=""
 +    flags_opt_all=""
 +    flags_opt_yes=""
 +    flags_opt_off=""
     CURL_CHECK_DEF([_WIN32], [], [silent])
   else
     AC_MSG_RESULT([no])
 --
 1.8.1.4
--- a/0002-fix-CVE-2021-3672.patch
+++ b/0002-fix-CVE-2021-3672.patch
@ -1,198 +0,0 @@
 From 4bde615c5fa2a6a6f61ca533e46a062691d83f45 Mon Sep 17 00:00:00 2001
 From: bradh352 <brad@brad-house.com>
 Date: Fri, 11 Jun 2021 11:27:45 -0400
 Subject: [PATCH 1/2] ares_expand_name() should escape more characters
 RFC1035 5.1 specifies some reserved characters and escaping sequences
 that are allowed to be specified.  Expand the list of reserved characters
 and also escape non-printable characters using the \DDD format as
 specified in the RFC.
 Bug Reported By: philipp.jeitner@sit.fraunhofer.de
 Fix By: Brad House (@bradh352)
 ---
 ares_expand_name.c | 41 ++++++++++++++++++++++++++++++++++++++---
 1 file changed, 38 insertions(+), 3 deletions(-)
 diff --git a/ares_expand_name.c b/ares_expand_name.c
 index 3a38e67..8604543 100644
 --- a/ares_expand_name.c
 +++ b/ares_expand_name.c
@@ -38,6 +38,26 @@
 static int name_length(const unsigned char *encoded, const unsigned char *abuf,
                        int alen);
 +/* Reserved characters for names that need to be escaped */
 +static int is_reservedch(int ch)
 +{
 +  switch (ch) {
 +    case '"':
 +    case '.':
 +    case ';':
 +    case '\\':
 +    case '(':
 +    case ')':
 +    case '@':
 +    case '$':
 +      return 1;
 +    default:
 +      break;
 +  }
 +
 +  return 0;
 +}
 +
 /* Expand an RFC1035-encoded domain name given by encoded.  The
  * containing message is given by abuf and alen.  The result given by
  * *s, which is set to a NUL-terminated allocated buffer.  *enclen is
@@ -117,9 +137,18 @@ int ares_expand_name(const unsigned char *encoded, const unsigned char *abuf,
           p++;
           while (len--)
             {
 -              if (*p == '.' || *p == '\\')
 +              if (!isprint(*p)) {
 +                /* Output as \DDD for consistency with RFC1035 5.1 */
 +                *q++ = '\\';
 +                *q++ = '0' + *p / 100;
 +                *q++ = '0' + (*p % 100) / 10;
 +                *q++ = '0' + (*p % 10);
 +              } else if (is_reservedch(*p)) {
                 *q++ = '\\';
 -              *q++ = *p;
 +                *q++ = *p;
 +              } else {
 +                *q++ = *p;
 +              }
               p++;
             }
           *q++ = '.';
@@ -177,7 +206,13 @@ static int name_length(const unsigned char *encoded, const unsigned char *abuf,
           encoded++;
           while (offset--)
             {
 -              n += (*encoded == '.' || *encoded == '\\') ? 2 : 1;
 +              if (!isprint(*encoded)) {
 +                n += 4;
 +              } else if (is_reservedch(*encoded)) {
 +                n += 2;
 +              } else {
 +                n += 1;
 +              }
               encoded++;
             }
           n++;
 -- 
 2.26.3
 From 86cc9241f89c1155111b992ccc03bf76d8ae634a Mon Sep 17 00:00:00 2001
 From: bradh352 <brad@brad-house.com>
 Date: Fri, 11 Jun 2021 12:39:24 -0400
 Subject: [PATCH 2/2] ares_expand_name(): fix formatting and handling of root
 name response
 Fixes issue introduced in prior commit with formatting and handling
 of parsing a root name response which should not be escaped.
 Fix By: Brad House
 ---
 ares_expand_name.c | 62 ++++++++++++++++++++++++++++++----------------
 1 file changed, 40 insertions(+), 22 deletions(-)
 diff --git a/ares_expand_name.c b/ares_expand_name.c
 index 8604543..f89ee3f 100644
 --- a/ares_expand_name.c
 +++ b/ares_expand_name.c
@@ -133,27 +133,37 @@ int ares_expand_name(const unsigned char *encoded, const unsigned char *abuf,
         }
       else
         {
 -          len = *p;
 +          int name_len = *p;
 +          len = name_len;
           p++;
 +
           while (len--)
             {
 -              if (!isprint(*p)) {
 -                /* Output as \DDD for consistency with RFC1035 5.1 */
 -                *q++ = '\\';
 -                *q++ = '0' + *p / 100;
 -                *q++ = '0' + (*p % 100) / 10;
 -                *q++ = '0' + (*p % 10);
 -              } else if (is_reservedch(*p)) {
 -                *q++ = '\\';
 -                *q++ = *p;
 -              } else {
 -                *q++ = *p;
 -              }
 +              /* Output as \DDD for consistency with RFC1035 5.1, except
 +               * for the special case of a root name response  */
 +              if (!isprint(*p) && !(name_len == 1 && *p == 0))
 +                {
 +
 +                  *q++ = '\\';
 +                  *q++ = '0' + *p / 100;
 +                  *q++ = '0' + (*p % 100) / 10;
 +                  *q++ = '0' + (*p % 10);
 +                }
 +              else if (is_reservedch(*p))
 +                {
 +                  *q++ = '\\';
 +                  *q++ = *p;
 +                }
 +              else
 +                {
 +                  *q++ = *p;
 +                }
               p++;
             }
           *q++ = '.';
         }
 -    }
 +     }
 +
   if (!indir)
     *enclen = aresx_uztosl(p + 1U - encoded);
@@ -200,21 +210,29 @@ static int name_length(const unsigned char *encoded, const unsigned char *abuf,
         }
       else if (top == 0x00)
         {
 -          offset = *encoded;
 +          int name_len = *encoded;
 +          offset = name_len;
           if (encoded + offset + 1 >= abuf + alen)
             return -1;
           encoded++;
 +
           while (offset--)
             {
 -              if (!isprint(*encoded)) {
 -                n += 4;
 -              } else if (is_reservedch(*encoded)) {
 -                n += 2;
 -              } else {
 -                n += 1;
 -              }
 +              if (!isprint(*encoded) && !(name_len == 1 && *encoded == 0))
 +                {
 +                  n += 4;
 +                }
 +              else if (is_reservedch(*encoded))
 +                {
 +                  n += 2;
 +                }
 +              else
 +                {
 +                  n += 1;
 +                }
               encoded++;
             }
 +
           n++;
         }
       else
 -- 
 2.26.3
--- a/0003-Add-str-len-check-in-config_sortlist-to-avoid-stack-.patch
+++ b/0003-Add-str-len-check-in-config_sortlist-to-avoid-stack-.patch
@ -1,64 +0,0 @@
 From 9903253c347f9e0bffd285ae3829aef251cc852d Mon Sep 17 00:00:00 2001
 From: hopper-vul <118949689+hopper-vul@users.noreply.github.com>
 Date: Wed, 18 Jan 2023 22:14:26 +0800
 Subject: [PATCH] Add str len check in config_sortlist to avoid stack overflow
 (#497)
 In ares_set_sortlist, it calls config_sortlist(..., sortstr) to parse
 the input str and initialize a sortlist configuration.
 However, ares_set_sortlist has not any checks about the validity of the input str.
 It is very easy to create an arbitrary length stack overflow with the unchecked
 `memcpy(ipbuf, str, q-str);` and `memcpy(ipbufpfx, str, q-str);`
 statements in the config_sortlist call, which could potentially cause severe
 security impact in practical programs.
 This commit add necessary check for `ipbuf` and `ipbufpfx` which avoid the
 potential stack overflows.
 fixes #496
 Fix By: @hopper-vul
 ---
 ares_init.c            | 4 ++++
 test/ares-test-init.cc | 2 ++
 2 files changed, 6 insertions(+)
 diff --git a/ares_init.c b/ares_init.c
 index f7b700b..5aad7c8 100644
 --- a/ares_init.c
 +++ b/ares_init.c
@@ -2065,6 +2065,8 @@ static int config_sortlist(struct apattern **sortlist, int *nsort,
       q = str;
       while (*q && *q != '/' && *q != ';' && !ISSPACE(*q))
         q++;
 +      if (q-str >= 16)
 +        return ARES_EBADSTR;
       memcpy(ipbuf, str, q-str);
       ipbuf[q-str] = '\0';
       /* Find the prefix */
@@ -2073,6 +2075,8 @@ static int config_sortlist(struct apattern **sortlist, int *nsort,
           const char *str2 = q+1;
           while (*q && *q != ';' && !ISSPACE(*q))
             q++;
 +          if (q-str >= 32)
 +            return ARES_EBADSTR;
           memcpy(ipbufpfx, str, q-str);
           ipbufpfx[q-str] = '\0';
           str = str2;
 diff --git a/test/ares-test-init.cc b/test/ares-test-init.cc
 index 63c6a22..ee84518 100644
 --- a/test/ares-test-init.cc
 +++ b/test/ares-test-init.cc
@@ -275,6 +275,8 @@ TEST_F(DefaultChannelTest, SetAddresses) {
 TEST_F(DefaultChannelTest, SetSortlistFailures) {
   EXPECT_EQ(ARES_ENODATA, ares_set_sortlist(nullptr, "1.2.3.4"));
 +  EXPECT_EQ(ARES_EBADSTR, ares_set_sortlist(channel_, "111.111.111.111*/16"));
 +  EXPECT_EQ(ARES_EBADSTR, ares_set_sortlist(channel_, "111.111.111.111/255.255.255.240*"));
   EXPECT_EQ(ARES_SUCCESS, ares_set_sortlist(channel_, "xyzzy ; lwk"));
   EXPECT_EQ(ARES_SUCCESS, ares_set_sortlist(channel_, "xyzzy ; 0x123"));
 }
 -- 
 2.37.3
--- a/0004-Merge-pull-request-from-GHSA-9g78-jv2r-p7vc.patch
+++ b/0004-Merge-pull-request-from-GHSA-9g78-jv2r-p7vc.patch
@ -1,82 +0,0 @@
 From b9b8413cfdb70a3f99e1573333b23052d57ec1ae Mon Sep 17 00:00:00 2001
 From: Brad House <brad@brad-house.com>
 Date: Mon, 22 May 2023 06:51:49 -0400
 Subject: [PATCH] Merge pull request from GHSA-9g78-jv2r-p7vc
 ---
 ares_process.c | 41 +++++++++++++++++++++++++----------------
 1 file changed, 25 insertions(+), 16 deletions(-)
 diff --git a/ares_process.c b/ares_process.c
 index bf0cde4..6cac0a9 100644
 --- a/ares_process.c
 +++ b/ares_process.c
@@ -470,7 +470,7 @@ static void read_udp_packets(ares_channel channel, fd_set *read_fds,
 {
   struct server_state *server;
   int i;
 -  ares_ssize_t count;
 +  ares_ssize_t read_len;
   unsigned char buf[MAXENDSSZ + 1];
 #ifdef HAVE_RECVFROM
   ares_socklen_t fromlen;
@@ -513,32 +513,41 @@ static void read_udp_packets(ares_channel channel, fd_set *read_fds,
       /* To reduce event loop overhead, read and process as many
        * packets as we can. */
       do {
 -        if (server->udp_socket == ARES_SOCKET_BAD)
 -          count = 0;
 -
 -        else {
 -          if (server->addr.family == AF_INET)
 +        if (server->udp_socket == ARES_SOCKET_BAD) {
 +          read_len = -1;
 +        } else {
 +          if (server->addr.family == AF_INET) {
             fromlen = sizeof(from.sa4);
 -          else
 +          } else {
             fromlen = sizeof(from.sa6);
 -          count = socket_recvfrom(channel, server->udp_socket, (void *)buf,
 -                                  sizeof(buf), 0, &from.sa, &fromlen);
 +          }
 +          read_len = socket_recvfrom(channel, server->udp_socket, (void *)buf,
 +                                     sizeof(buf), 0, &from.sa, &fromlen);
         }
 -        if (count == -1 && try_again(SOCKERRNO))
 +        if (read_len == 0) {
 +          /* UDP is connectionless, so result code of 0 is a 0-length UDP
 +           * packet, and not an indication the connection is closed like on
 +           * tcp */
           continue;
 -        else if (count <= 0)
 +        } else if (read_len < 0) {
 +          if (try_again(SOCKERRNO))
 +            continue;
 +
           handle_error(channel, i, now);
 +
 #ifdef HAVE_RECVFROM
 -        else if (!same_address(&from.sa, &server->addr))
 +        } else if (!same_address(&from.sa, &server->addr)) {
           /* The address the response comes from does not match the address we
            * sent the request to. Someone may be attempting to perform a cache
            * poisoning attack. */
 -          break;
 +          continue;
 #endif
 -        else
 -          process_answer(channel, buf, (int)count, i, 0, now);
 -       } while (count > 0);
 +
 +        } else {
 +          process_answer(channel, buf, (int)read_len, i, 0, now);
 +        }
 +      } while (read_len >= 0);
     }
 }
 -- 
 2.38.1
--- a/0005-avoid-read-heap-buffer-overflow-332.patch
+++ b/0005-avoid-read-heap-buffer-overflow-332.patch
@ -1,30 +0,0 @@
 From 65f83b8bf15a128524ef5fe26e1f1e219ee9b872 Mon Sep 17 00:00:00 2001
 From: Alexey Tikhonov <atikhono@redhat.com>
 Date: Fri, 1 Sep 2023 20:00:12 +0200
 Subject: [PATCH] avoid read-heap-buffer-overflow (#332)
 Fix invalid read in ares_parse_soa_reply.c found during fuzzing
 Fixes Bug: #333
 Fix By: lutianxiong (@ltx2018)
 ---
 ares_parse_soa_reply.c | 3 +++
 1 file changed, 3 insertions(+)
 diff --git a/ares_parse_soa_reply.c b/ares_parse_soa_reply.c
 index 35af0a7..5924bbc 100644
 --- a/ares_parse_soa_reply.c
 +++ b/ares_parse_soa_reply.c
@@ -65,6 +65,9 @@ ares_parse_soa_reply(const unsigned char *abuf, int alen,
   status = ares__expand_name_for_response(aptr, abuf, alen, &qname, &len);
   if (status != ARES_SUCCESS)
     goto failed_stat;
 +
 +  if (alen <= len + HFIXEDSZ + 1)
 +    goto failed;
   aptr += len;
   /* skip qtype & qclass */
 -- 
 2.38.1
--- a/0006-Merge-pull-request-from-GHSA-x6mf-cxr9-8q6v.patch
+++ b/0006-Merge-pull-request-from-GHSA-x6mf-cxr9-8q6v.patch
@ -1,294 +0,0 @@
 From f22cc01039b6473b736d3bf438f56a2654cdf2b2 Mon Sep 17 00:00:00 2001
 From: Brad House <brad@brad-house.com>
 Date: Mon, 22 May 2023 06:51:34 -0400
 Subject: [PATCH] Merge pull request from GHSA-x6mf-cxr9-8q6v
 * Merged latest OpenBSD changes for inet_net_pton_ipv6() into c-ares.
 * Always use our own IP conversion functions now, do not delegate to OS
  so we can have consistency in testing and fuzzing.
 Fix By: Brad House (@bradh352)
 ---
 inet_net_pton.c    | 155 ++++++++++++++++++++-----------------
 diff --git a/inet_net_pton.c b/inet_net_pton.c
 index 840de50..fc50425 100644
 --- a/inet_net_pton.c
 +++ b/inet_net_pton.c
@@ -1,19 +1,20 @@
 /*
 - * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
 + * Copyright (c) 2012 by Gilles Chehade <gilles@openbsd.org>
  * Copyright (c) 1996,1999 by Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
 - * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
 - * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 - * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
 - * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 - * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 - * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
 - * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 + * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
 + * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
 + * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
 + * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
 + * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
 + * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
 + * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
 + * SOFTWARE.
  */
 #include "ares_setup.h"
@@ -35,9 +36,6 @@
 const struct ares_in6_addr ares_in6addr_any = { { { 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 } } };
 -
 -#ifndef HAVE_INET_NET_PTON
 -
 /*
  * static int
  * inet_net_pton_ipv4(src, dst, size)
@@ -60,7 +58,7 @@ const struct ares_in6_addr ares_in6addr_any = { { { 0,0,0,0,0,0,0,0,0,0,0,0,0,0,
  *      Paul Vixie (ISC), June 1996
  */
 static int
 -inet_net_pton_ipv4(const char *src, unsigned char *dst, size_t size)
 +ares_inet_net_pton_ipv4(const char *src, unsigned char *dst, size_t size)
 {
   static const char xdigits[] = "0123456789abcdef";
   static const char digits[] = "0123456789";
@@ -261,19 +259,14 @@ getv4(const char *src, unsigned char *dst, int *bitsp)
 }
 static int
 -inet_net_pton_ipv6(const char *src, unsigned char *dst, size_t size)
 +ares_inet_pton6(const char *src, unsigned char *dst)
 {
   static const char xdigits_l[] = "0123456789abcdef",
 -    xdigits_u[] = "0123456789ABCDEF";
 +        xdigits_u[] = "0123456789ABCDEF";
   unsigned char tmp[NS_IN6ADDRSZ], *tp, *endp, *colonp;
   const char *xdigits, *curtok;
 -  int ch, saw_xdigit;
 +  int ch, saw_xdigit, count_xdigit;
   unsigned int val;
 -  int digits;
 -  int bits;
 -  size_t bytes;
 -  int words;
 -  int ipv4;
   memset((tp = tmp), '\0', NS_IN6ADDRSZ);
   endp = tp + NS_IN6ADDRSZ;
@@ -283,22 +276,22 @@ inet_net_pton_ipv6(const char *src, unsigned char *dst, size_t size)
     if (*++src != ':')
       goto enoent;
   curtok = src;
 -  saw_xdigit = 0;
 +  saw_xdigit = count_xdigit = 0;
   val = 0;
 -  digits = 0;
 -  bits = -1;
 -  ipv4 = 0;
   while ((ch = *src++) != '\0') {
     const char *pch;
     if ((pch = strchr((xdigits = xdigits_l), ch)) == NULL)
       pch = strchr((xdigits = xdigits_u), ch);
     if (pch != NULL) {
 +      if (count_xdigit >= 4)
 +        goto enoent;
       val <<= 4;
 -      val |= aresx_sztoui(pch - xdigits);
 -      if (++digits > 4)
 +      val |= (pch - xdigits);
 +      if (val > 0xffff)
         goto enoent;
       saw_xdigit = 1;
 +      count_xdigit++;
       continue;
     }
     if (ch == ':') {
@@ -308,78 +301,107 @@ inet_net_pton_ipv6(const char *src, unsigned char *dst, size_t size)
           goto enoent;
         colonp = tp;
         continue;
 -      } else if (*src == '\0')
 +      } else if (*src == '\0') {
         goto enoent;
 +      }
       if (tp + NS_INT16SZ > endp)
 -        return (0);
 -      *tp++ = (unsigned char)((val >> 8) & 0xff);
 -      *tp++ = (unsigned char)(val & 0xff);
 +        goto enoent;
 +      *tp++ = (unsigned char) (val >> 8) & 0xff;
 +      *tp++ = (unsigned char) val & 0xff;
       saw_xdigit = 0;
 -      digits = 0;
 +      count_xdigit = 0;
       val = 0;
       continue;
     }
     if (ch == '.' && ((tp + NS_INADDRSZ) <= endp) &&
 -        getv4(curtok, tp, &bits) > 0) {
 -      tp += NS_INADDRSZ;
 +        ares_inet_net_pton_ipv4(curtok, tp, INADDRSZ) > 0) {
 +      tp += INADDRSZ;
       saw_xdigit = 0;
 -      ipv4 = 1;
 +      count_xdigit = 0;
       break;  /* '\0' was seen by inet_pton4(). */
     }
 -    if (ch == '/' && getbits(src, &bits) > 0)
 -      break;
     goto enoent;
   }
   if (saw_xdigit) {
     if (tp + NS_INT16SZ > endp)
       goto enoent;
 -    *tp++ = (unsigned char)((val >> 8) & 0xff);
 -    *tp++ = (unsigned char)(val & 0xff);
 +    *tp++ = (unsigned char) (val >> 8) & 0xff;
 +    *tp++ = (unsigned char) val & 0xff;
   }
 -  if (bits == -1)
 -    bits = 128;
 -
 -  words = (bits + 15) / 16;
 -  if (words < 2)
 -    words = 2;
 -  if (ipv4)
 -    words = 8;
 -  endp =  tmp + 2 * words;
 -
   if (colonp != NULL) {
     /*
      * Since some memmove()'s erroneously fail to handle
      * overlapping regions, we'll do the shift by hand.
      */
 -    const ares_ssize_t n = tp - colonp;
 -    ares_ssize_t i;
 +    const int n = tp - colonp;
 +    int i;
     if (tp == endp)
       goto enoent;
     for (i = 1; i <= n; i++) {
 -      *(endp - i) = *(colonp + n - i);
 -      *(colonp + n - i) = 0;
 +      endp[- i] = colonp[n - i];
 +      colonp[n - i] = 0;
     }
     tp = endp;
   }
   if (tp != endp)
     goto enoent;
 -  bytes = (bits + 7) / 8;
 -  if (bytes > size)
 -    goto emsgsize;
 -  memcpy(dst, tmp, bytes);
 -  return (bits);
 +  memcpy(dst, tmp, NS_IN6ADDRSZ);
 +  return (1);
 -  enoent:
 +enoent:
   SET_ERRNO(ENOENT);
   return (-1);
 -  emsgsize:
 +emsgsize:
   SET_ERRNO(EMSGSIZE);
   return (-1);
 }
 +static int
 +ares_inet_net_pton_ipv6(const char *src, unsigned char *dst, size_t size)
 +{
 +  struct ares_in6_addr in6;
 +  int                  ret;
 +  int                  bits;
 +  size_t               bytes;
 +  char                 buf[INET6_ADDRSTRLEN + sizeof("/128")];
 +  char                *sep;
 +  const char          *errstr;
 +
 +  if (strlen(src) >= sizeof buf) {
 +    SET_ERRNO(EMSGSIZE);
 +    return (-1);
 +  }
 +  strncpy(buf, src, sizeof buf);
 +
 +  sep = strchr(buf, '/');
 +  if (sep != NULL)
 +    *sep++ = '\0';
 +
 +  ret = ares_inet_pton6(buf, (unsigned char *)&in6);
 +  if (ret != 1)
 +    return (-1);
 +
 +  if (sep == NULL)
 +    bits = 128;
 +  else {
 +    if (!getbits(sep, &bits)) {
 +      SET_ERRNO(ENOENT);
 +      return (-1);
 +    }
 +  }
 +
 +  bytes = (bits + 7) / 8;
 +  if (bytes > size) {
 +    SET_ERRNO(EMSGSIZE);
 +    return (-1);
 +  }
 +  memcpy(dst, &in6, bytes);
 +  return (bits);
 +}
 +
 /*
  * int
  * inet_net_pton(af, src, dst, size)
@@ -403,18 +425,15 @@ ares_inet_net_pton(int af, const char *src, void *dst, size_t size)
 {
   switch (af) {
   case AF_INET:
 -    return (inet_net_pton_ipv4(src, dst, size));
 +    return (ares_inet_net_pton_ipv4(src, dst, size));
   case AF_INET6:
 -    return (inet_net_pton_ipv6(src, dst, size));
 +    return (ares_inet_net_pton_ipv6(src, dst, size));
   default:
     SET_ERRNO(EAFNOSUPPORT);
     return (-1);
   }
 }
 -#endif /* HAVE_INET_NET_PTON */
 -
 -#ifndef HAVE_INET_PTON
 int ares_inet_pton(int af, const char *src, void *dst)
 {
   int result;
@@ -434,11 +453,3 @@ int ares_inet_pton(int af, const char *src, void *dst)
     return 0;
   return (result > -1 ? 1 : -1);
 }
 -#else /* HAVE_INET_PTON */
 -int ares_inet_pton(int af, const char *src, void *dst)
 -{
 -  /* just relay this to the underlying function */
 -  return inet_pton(af, src, dst);
 -}
 -
 -#endif
 -- 
 2.41.0
--- a/0007-Merge-pull-request-from-GHSA-mg26-v6qh-x48q.patch
+++ b/0007-Merge-pull-request-from-GHSA-mg26-v6qh-x48q.patch
@ -1,33 +0,0 @@
 From 5fdda1a5891f8828075225975fbdef1d3e87fb57 Mon Sep 17 00:00:00 2001
 From: Alexey Tikhonov <atikhono@redhat.com>
 Date: Mon, 11 Mar 2024 20:46:09 +0100
 Subject: [PATCH] Merge pull request from GHSA-mg26-v6qh-x48q
 Backported from
 https://github.com/c-ares/c-ares/commit/a804c04ddc8245fc8adf0e92368709639125e183
 ---
 ares__read_line.c | 8 ++++++++
 1 file changed, 8 insertions(+)
 diff --git a/ares__read_line.c b/ares__read_line.c
 index c62ad2a..d6625a3 100644
 --- a/ares__read_line.c
 +++ b/ares__read_line.c
@@ -49,6 +49,14 @@ int ares__read_line(FILE *fp, char **buf, size_t *bufsize)
       if (!fgets(*buf + offset, bytestoread, fp))
         return (offset != 0) ? 0 : (ferror(fp)) ? ARES_EFILE : ARES_EOF;
       len = offset + strlen(*buf + offset);
 +
 +      /* Probably means there was an embedded NULL as the first character in
 +       * the line, throw away line */
 +      if (len == 0) {
 +        offset = 0;
 +        continue;
 +      }
 +
       if ((*buf)[len - 1] == '\n')
         {
           (*buf)[len - 1] = 0;
 -- 
 2.42.0
--- a/12
+++ b/12
@ -1,12 +0,0 @@
 Copyright (C) 2004 by Daniel Stenberg et al
 Permission to use, copy, modify, and distribute this software and its
 documentation for any purpose and without fee is hereby granted, provided
 that the above copyright notice appear in all copies and that both that
 copyright notice and this permission notice appear in supporting
 documentation, and that the name of M.I.T. not be used in advertising or
 publicity pertaining to distribution of the software without specific,
 written prior permission.  M.I.T. makes no representations about the
 suitability of this software for any purpose.  It is provided "as is"
 without express or implied warranty.
--- a/c-ares-1.34.6-CVE-2026-33630.patch
+++ b/c-ares-1.34.6-CVE-2026-33630.patch
@ -0,0 +1,472 @@
 From f1134474ed2b19374556515d6fdd33aae4250125 Mon Sep 17 00:00:00 2001
 From: Brad House <brad@brad-house.com>
 Date: Mon, 6 Jul 2026 11:19:36 -0400
 Subject: [PATCH] [Backport v1.34] Fix double-free in process_timeouts() and
 consolidate requeue handling (#1237)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Backports the double-free fix (**GHSA-6wfj-rwm7-3542** /
 **CVE-2026-33630**) and the requeue-recursion fix for #1043 to the
 `v1.34` release branch.
 Cherry-pick of main commit 1fa3b86a0b8d18fe7b60f3228a01d770feb026bc —
 applied cleanly (diff identical to main; v1.34 already carried the
 `requeue`-array infrastructure from the earlier security merge, so this
 adds the `ares_flush_requeue()` / `ares_send_query_int()` consolidation
 on top).
 ## What it fixes
 - **Double-free (self-cancellation):** `process_timeouts()` invoked the
 query callback without first detaching the query from `queries_by_qid` /
 `all_queries`, so a reentrant `ares_cancel()` from the callback freed
 the query which was then freed again by the caller. The same
 self-cancellation double-free was also reachable via `read_answers()`'
 deferred ENDQUERY flush.
 - **#1043 stack overflow:** unbounded `ares_requeue_query()` →
 `ares_send_query()` recursion.
 Both share one root cause — deferred work being done immediately. Every
 flush site now funnels through `ares_flush_requeue()`, which
 re-dispatches retries iteratively and fully detaches each query before
 invoking its callback.
 ## Verification
 - CMake + Ninja Debug build clean, no warnings in `ares_process.c`.
 - Regression tests pass, including `CancelInCallbackNoDoubleFree` and
 `NoSocketExplosionOnTimeout` (91 targeted cancel/timeout tests green).
 Target release: **1.34.7**.
 ---
 src/lib/ares_process.c | 185 ++++++++++++++++++++++++++++++-----------
 test/ares-test-mock.cc | 111 +++++++++++++++++++++++++
 2 files changed, 248 insertions(+), 48 deletions(-)
 diff --git a/src/lib/ares_process.c b/src/lib/ares_process.c
 index 93529684..cafc05bd 100644
 --- a/src/lib/ares_process.c
 +++ b/src/lib/ares_process.c
@@ -66,6 +66,11 @@ static void        end_query(ares_channel_t *channel, ares_server_t *server,
                              ares_query_t *query, ares_status_t status,
                              ares_dns_record_t *dnsrec,
                              ares_array_t **requeue);
 +static ares_status_t ares_send_query_int(ares_server_t        *requested_server,
 +                                         ares_query_t         *query,
 +                                         const ares_timeval_t *now,
 +                                         ares_array_t        **requeue);
 +static void          ares_detach_query(ares_query_t *query);
 static void        ares_query_remove_from_conn(ares_query_t *query)
 {
@@ -573,6 +578,79 @@ static ares_status_t ares_append_endqueue(ares_array_t     **requeue,
     dnsrec);
 }
 +/* Drain the deferred requeue/endqueue list iteratively.  All flush sites
 + * (read_answers(), process_timeouts(), and ares_send_query()) funnel through
 + * here so that:
 + *   1. Retries are re-dispatched by appending to this same list and looping,
 + *      rather than recursing ares_requeue_query() -> ares_send_query() until
 + *      the stack is exhausted (issue #1043).
 + *   2. A query is fully detached from all lookup lists before its callback is
 + *      invoked, so a reentrant ares_cancel() from within that callback cannot
 + *      find and free the same query, which would otherwise double-free it
 + *      (CVE-2026-33630 / GHSA-6wfj-rwm7-3542).
 + *
 + * On return the list has been fully processed, an empty-queue notification has
 + * been sent if appropriate, and *requeue has been destroyed and set to NULL. */
 +static ares_status_t ares_flush_requeue(ares_channel_t       *channel,
 +                                        const ares_timeval_t *now,
 +                                        ares_array_t        **requeue)
 +{
 +  ares_status_t status = ARES_SUCCESS;
 +
 +  if (requeue == NULL) {
 +    return status;
 +  }
 +
 +  while (*requeue != NULL && ares_array_len(*requeue) > 0) {
 +    ares_query_t  *query;
 +    ares_requeue_t entry;
 +    ares_status_t  internal_status;
 +
 +    internal_status = ares_array_claim_at(&entry, sizeof(entry), *requeue, 0);
 +    if (internal_status != ARES_SUCCESS) {
 +      break; /* LCOV_EXCL_LINE: DefensiveCoding */
 +    }
 +
 +    query = ares_htable_szvp_get_direct(channel->queries_by_qid, entry.qid);
 +
 +    if (entry.type == REQUEUE_REQUEUE) {
 +      /* Query disappeared (e.g. a prior callback in this drain cancelled it) */
 +      if (query == NULL) {
 +        continue;
 +      }
 +      /* Re-dispatch via the internal entrypoint so any further requeues are
 +       * appended back onto this same list and drained by the loop above,
 +       * rather than recursing. */
 +      internal_status = ares_send_query_int(entry.server, query, now, requeue);
 +      /* We only care about ARES_ENOMEM */
 +      if (internal_status == ARES_ENOMEM) {
 +        status = ARES_ENOMEM;
 +      }
 +    } else { /* REQUEUE_ENDQUERY */
 +      if (query != NULL) {
 +        /* Detach the query from all lookup lists BEFORE invoking the callback.
 +         * Otherwise a reentrant ares_cancel() from within the callback would
 +         * find this query still linked in all_queries/queries_by_qid, free it,
 +         * and the ares_free_query() below would then double-free it. */
 +        ares_detach_query(query);
 +        query->callback(query->arg, entry.status, query->timeouts,
 +                        entry.dnsrec);
 +        ares_free_query(query);
 +      }
 +      ares_dns_record_destroy(entry.dnsrec);
 +    }
 +  }
 +
 +  /* Don't forget to send notification if queue emptied */
 +  if (*requeue != NULL) {
 +    ares_queue_notify_empty(channel);
 +  }
 +  ares_array_destroy(*requeue);
 +  *requeue = NULL;
 +
 +  return status;
 +}
 +
 static ares_status_t read_answers(ares_conn_t *conn, const ares_timeval_t *now)
 {
   ares_status_t   status;
@@ -625,43 +703,11 @@ static ares_status_t read_answers(ares_conn_t *conn, const ares_timeval_t *now)
   }
 cleanup:
 -
 -  /* Flush requeue */
 -  while (ares_array_len(requeue) > 0) {
 -    ares_query_t  *query;
 -    ares_requeue_t entry;
 -    ares_status_t  internal_status;
 -
 -    internal_status = ares_array_claim_at(&entry, sizeof(entry), requeue, 0);
 -    if (internal_status != ARES_SUCCESS) {
 -      break;
 -    }
 -
 -    query = ares_htable_szvp_get_direct(channel->queries_by_qid, entry.qid);
 -
 -    if (entry.type == REQUEUE_REQUEUE) {
 -      /* query disappeared */
 -      if (query == NULL) {
 -        continue;
 -      }
 -      internal_status = ares_send_query(entry.server, query, now);
 -      /* We only care about ARES_ENOMEM */
 -      if (internal_status == ARES_ENOMEM) {
 -        status = ARES_ENOMEM;
 -      }
 -    } else { /* REQUEUE_ENDQUERY */
 -      if (query != NULL) {
 -        query->callback(query->arg, entry.status, query->timeouts, entry.dnsrec);
 -        ares_free_query(query);
 -      }
 -      ares_dns_record_destroy(entry.dnsrec);
 -    }
 -  }
 -  /* Don't forget to send notification if queue emptied */
 -  if (requeue != NULL) {
 -    ares_queue_notify_empty(channel);
 +  /* Flush requeue - re-dispatch retries and invoke deferred callbacks
 +   * iteratively and safely */
 +  if (ares_flush_requeue(channel, now, &requeue) == ARES_ENOMEM) {
 +    status = ARES_ENOMEM;
   }
 -  ares_array_destroy(requeue);
   return status;
 }
@@ -696,7 +742,8 @@ static ares_status_t process_timeouts(ares_channel_t       *channel,
                                       const ares_timeval_t *now)
 {
   ares_slist_node_t *node;
 -  ares_status_t      status = ARES_SUCCESS;
 +  ares_status_t      status  = ARES_SUCCESS;
 +  ares_array_t      *requeue = NULL;
   /* Just keep popping off the first as this list will re-sort as things come
    * and go.  We don't want to try to rely on 'next' as some operation might
@@ -715,13 +762,19 @@ static ares_status_t process_timeouts(ares_channel_t       *channel,
     conn = query->conn;
     server_increment_failures(conn->server, query->using_tcp);
 -    status = ares_requeue_query(query, now, ARES_ETIMEOUT, ARES_TRUE, NULL,
 -      NULL);
 +    status =
 +      ares_requeue_query(query, now, ARES_ETIMEOUT, ARES_TRUE, NULL, &requeue);
     if (status == ARES_ENOMEM) {
       goto done;
     }
   }
 done:
 +  /* Flush requeue - re-dispatch retries and invoke deferred callbacks
 +   * iteratively and safely */
 +  if (ares_flush_requeue(channel, now, &requeue) == ARES_ENOMEM) {
 +    status = ARES_ENOMEM;
 +  }
 +
   if (status == ARES_ENOMEM) {
     return ARES_ENOMEM;
   }
@@ -871,7 +924,7 @@ static ares_status_t process_answer(ares_channel_t      *channel,
   if (issue_might_be_edns(query->query, rdnsrec)) {
     status = rewrite_without_edns(query);
     if (status != ARES_SUCCESS) {
 -      end_query(channel, server, query, status, NULL, NULL);
 +      end_query(channel, server, query, status, NULL, requeue);
       goto cleanup;
     }
@@ -1262,8 +1315,44 @@ static ares_status_t ares_conn_query_write(ares_conn_t          *conn,
   return ares_conn_flush(conn);
 }
 +/* Public entrypoint.  Establishes a requeue list and drives
 + * ares_send_query_int() plus any retries/deferred callbacks it produces
 + * iteratively, so a chain of retryable failures can never recurse until the
 + * stack is exhausted (#1043). */
 ares_status_t ares_send_query(ares_server_t *requested_server,
                               ares_query_t *query, const ares_timeval_t *now)
 +{
 +  ares_channel_t *channel = query->channel;
 +  ares_array_t   *requeue = NULL;
 +  unsigned short  qid     = query->qid;
 +  ares_status_t   status;
 +
 +  status = ares_send_query_int(requested_server, query, now, &requeue);
 +
 +  /* Drain any retries/deferred callbacks this send produced.
 +   * ares_flush_requeue() always fully processes and destroys the list (even on
 +   * ENOMEM), and sends the empty-queue notification if needed. */
 +  if (ares_flush_requeue(channel, now, &requeue) == ARES_ENOMEM) {
 +    status = ARES_ENOMEM;
 +  }
 +
 +  /* A retry may have been deferred (returning ARES_SUCCESS from the append)
 +   * and then terminally failed while draining, in which case the query has
 +   * been freed.  Do not dereference 'query' here.  If it is no longer tracked
 +   * it ended, so don't report success to the caller (which would, e.g., cause
 +   * ares_send_nolock() to write to a now-freed *qid). */
 +  if (status == ARES_SUCCESS &&
 +      ares_htable_szvp_get_direct(channel->queries_by_qid, qid) == NULL) {
 +    status = ARES_ETIMEOUT;
 +  }
 +
 +  return status;
 +}
 +
 +static ares_status_t ares_send_query_int(ares_server_t        *requested_server,
 +                                         ares_query_t         *query,
 +                                         const ares_timeval_t *now,
 +                                         ares_array_t        **requeue)
 {
   ares_channel_t *channel = query->channel;
   ares_server_t  *server;
@@ -1286,7 +1375,7 @@ ares_status_t ares_send_query(ares_server_t *requested_server,
   }
   if (server == NULL) {
 -    end_query(channel, server, query, ARES_ENOSERVER /* ? */, NULL, NULL);
 +    end_query(channel, server, query, ARES_ENOSERVER /* ? */, NULL, requeue);
     return ARES_ENOSERVER;
   }
@@ -1310,11 +1399,11 @@ ares_status_t ares_send_query(ares_server_t *requested_server,
       case ARES_ECONNREFUSED:
       case ARES_EBADFAMILY:
         server_increment_failures(server, query->using_tcp);
 -        return ares_requeue_query(query, now, status, ARES_TRUE, NULL, NULL);
 +        return ares_requeue_query(query, now, status, ARES_TRUE, NULL, requeue);
       /* Anything else is not retryable, likely ENOMEM */
       default:
 -        end_query(channel, server, query, status, NULL, NULL);
 +        end_query(channel, server, query, status, NULL, requeue);
         return status;
     }
   }
@@ -1328,7 +1417,7 @@ ares_status_t ares_send_query(ares_server_t *requested_server,
     case ARES_ENOMEM:
       /* Not retryable */
 -      end_query(channel, server, query, status, NULL, NULL);
 +      end_query(channel, server, query, status, NULL, requeue);
       return status;
     /* These conditions are retryable as they are server-specific
@@ -1336,7 +1425,7 @@ ares_status_t ares_send_query(ares_server_t *requested_server,
     case ARES_ECONNREFUSED:
     case ARES_EBADFAMILY:
       handle_conn_error(conn, ARES_TRUE, status);
 -      status = ares_requeue_query(query, now, status, ARES_TRUE, NULL, NULL);
 +      status = ares_requeue_query(query, now, status, ARES_TRUE, NULL, requeue);
       if (status == ARES_ETIMEOUT) {
         status = ARES_ECONNREFUSED;
       }
@@ -1344,7 +1433,7 @@ ares_status_t ares_send_query(ares_server_t *requested_server,
     default:
       server_increment_failures(server, query->using_tcp);
 -      status = ares_requeue_query(query, now, status, ARES_TRUE, NULL, NULL);
 +      status = ares_requeue_query(query, now, status, ARES_TRUE, NULL, requeue);
       return status;
   }
@@ -1360,7 +1449,7 @@ ares_status_t ares_send_query(ares_server_t *requested_server,
     ares_slist_insert(channel->queries_by_timeout, query);
   if (!query->node_queries_by_timeout) {
     /* LCOV_EXCL_START: OutOfMemory */
 -    end_query(channel, server, query, ARES_ENOMEM, NULL, NULL);
 +    end_query(channel, server, query, ARES_ENOMEM, NULL, requeue);
     return ARES_ENOMEM;
     /* LCOV_EXCL_STOP */
   }
@@ -1373,7 +1462,7 @@ ares_status_t ares_send_query(ares_server_t *requested_server,
   if (query->node_queries_to_conn == NULL) {
     /* LCOV_EXCL_START: OutOfMemory */
 -    end_query(channel, server, query, ARES_ENOMEM, NULL, NULL);
 +    end_query(channel, server, query, ARES_ENOMEM, NULL, requeue);
     return ARES_ENOMEM;
     /* LCOV_EXCL_STOP */
   }
 diff --git a/test/ares-test-mock.cc b/test/ares-test-mock.cc
 index 4b60eee8..35789e17 100644
 --- a/test/ares-test-mock.cc
 +++ b/test/ares-test-mock.cc
@@ -1722,6 +1722,115 @@ TEST_P(MockUDPChannelTest, TriggerResendThenConnFailEDNS) {
   EXPECT_EQ("{'www.google.com' aliases=[] addrs=[1.2.3.4]}", ss.str());
 }
 +// Regression for issue #1043: a long chain of retryable connection failures
 +// used to recurse ares_requeue_query() -> ares_send_query() until the stack was
 +// exhausted.  With a very high retry count and a socket that always fails to be
 +// created (a retryable ARES_ECONNREFUSED), the retries must be processed
 +// iteratively and the query must terminate cleanly rather than crashing.
 +class MockRetryDepthChannelTest : public MockChannelOptsTest,
 +                                  public ::testing::WithParamInterface<int> {
 +public:
 +  MockRetryDepthChannelTest()
 +    : MockChannelOptsTest(1, GetParam(), false, false, FillOptions(&opts_),
 +                          ARES_OPT_TRIES)
 +  {
 +  }
 +
 +  static struct ares_options *FillOptions(struct ares_options *opts)
 +  {
 +    memset(opts, 0, sizeof(struct ares_options));
 +    /* Large enough that the old recursive path would overflow the stack. */
 +    opts->tries = 100000;
 +    return opts;
 +  }
 +
 +private:
 +  struct ares_options opts_;
 +};
 +
 +static size_t g_always_fail_socket_calls = 0;
 +
 +static ares_socket_t always_fail_socket(int af, int type, int protocol,
 +                                        void *user_data)
 +{
 +  (void)af;
 +  (void)type;
 +  (void)protocol;
 +  (void)user_data;
 +  g_always_fail_socket_calls++;
 +  return ARES_SOCKET_BAD;
 +}
 +
 +TEST_P(MockRetryDepthChannelTest, HighRetryNoStackOverflow) {
 +  ares_socket_functions sock_funcs;
 +  memset(&sock_funcs, 0, sizeof(sock_funcs));
 +  sock_funcs.asocket = always_fail_socket;
 +  ares_set_socket_functions(channel_, &sock_funcs, NULL);
 +
 +  g_always_fail_socket_calls = 0;
 +
 +  QueryResult result;
 +  ares_query_dnsrec(channel_, "www.google.com", ARES_CLASS_IN, ARES_REC_TYPE_A,
 +                    QueryCallback, &result, NULL);
 +  Process();
 +
 +  /* If the retries didn't drive the query to a terminal state on their own
 +   * (e.g. it parked awaiting a response that will never arrive), cancel it so
 +   * the query terminates deterministically. */
 +  if (!result.done_) {
 +    ares_cancel(channel_);
 +    Process();
 +  }
 +
 +  /* The essential property is that we reached this point at all: on unpatched
 +   * code the retryable failures recursed ares_requeue_query()/ares_send_query()
 +   * until the stack overflowed and the process aborted before getting here.  We
 +   * also confirm the retries were attempted iteratively (more than one socket
 +   * creation) and that the query reached a terminal state. */
 +  EXPECT_GT(g_always_fail_socket_calls, (size_t)1);
 +  EXPECT_TRUE(result.done_);
 +}
 +
 +// Regression for CVE-2026-33630 / GHSA-6wfj-rwm7-3542: invoking ares_cancel()
 +// from within a normal response callback must not double-free the query.  The
 +// callback is dispatched from the read_answers() deferred-requeue flush, and the
 +// query must be detached from all lookup lists before the callback runs so that
 +// the reentrant ares_cancel() cannot find and free it a second time.
 +struct CancelInCbData {
 +  ares_channel_t *channel;
 +  bool            done;
 +};
 +
 +static void CancelChannelCallback(void *arg, ares_status_t status,
 +                                  size_t timeouts,
 +                                  const ares_dns_record_t *dnsrec)
 +{
 +  CancelInCbData *data = static_cast<CancelInCbData *>(arg);
 +  (void)status;
 +  (void)timeouts;
 +  (void)dnsrec;
 +  data->done = true;
 +  /* Reentrant cancel from within the callback.  Must not double-free. */
 +  ares_cancel(data->channel);
 +}
 +
 +TEST_P(MockUDPChannelTest, CancelInCallbackNoDoubleFree) {
 +  DNSPacket reply;
 +  reply.set_response().set_aa()
 +    .add_question(new DNSQuestion("www.google.com", T_A))
 +    .add_answer(new DNSARR("www.google.com", 0x0100, {0x01, 0x02, 0x03, 0x04}));
 +  ON_CALL(server_, OnRequest("www.google.com", T_A))
 +    .WillByDefault(SetReply(&server_, &reply));
 +
 +  CancelInCbData data;
 +  data.channel = channel_;
 +  data.done    = false;
 +  ares_query_dnsrec(channel_, "www.google.com", ARES_CLASS_IN, ARES_REC_TYPE_A,
 +                    CancelChannelCallback, &data, NULL);
 +  Process();
 +  EXPECT_TRUE(data.done);
 +}
 +
 TEST_P(MockUDPChannelTest, GetSock) {
   DNSPacket reply;
   reply.set_response().set_aa()
@@ -2573,6 +2682,8 @@ INSTANTIATE_TEST_SUITE_P(AddressFamilies, ContainedMockChannelSysConfig, ::testi
 INSTANTIATE_TEST_SUITE_P(AddressFamilies, MockUDPChannelTest, ::testing::ValuesIn(ares::test::families), PrintFamily);
 +INSTANTIATE_TEST_SUITE_P(AddressFamilies, MockRetryDepthChannelTest, ::testing::ValuesIn(ares::test::families), PrintFamily);
 +
 INSTANTIATE_TEST_SUITE_P(AddressFamilies, MockUDPMaxQueriesTest, ::testing::ValuesIn(ares::test::families), PrintFamily);
 INSTANTIATE_TEST_SUITE_P(AddressFamilies, CacheQueriesTest, ::testing::ValuesIn(ares::test::families), PrintFamily);
--- a/c-ares.spec
+++ b/c-ares.spec
@ -1,26 +1,24 @@
 %global use_cmake 1
 Summary: A library that performs asynchronous DNS operations
 Name: c-ares
-Version: 1.13.0
+Version: 1.34.6
-Release: 11%{?dist}
+Release: 2%{?dist}
 License: MIT
-Group: System Environment/Libraries
+URL: http://c-ares.org/
-URL: http://c-ares.haxx.se/
+Source0: https://github.com/c-ares/c-ares/releases/download/v%{version}/c-ares-%{version}.tar.gz
-Source0: http://c-ares.haxx.se/download/%{name}-%{version}.tar.gz
+#Patch0: 0001-Merge-pull-request-from-GHSA-mg26-v6qh-x48q.patch
-# The license can be obtained at http://c-ares.haxx.se/license.html
+# https://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a
-Source1: LICENSE
+Patch1: c-ares-1.34.6-CVE-2026-33630.patch
-Patch0: 0001-Use-RPM-compiler-options.patch
+BuildRequires: gcc
-Patch1: 0002-fix-CVE-2021-3672.patch
+%if %{use_cmake}
-Patch2: 0003-Add-str-len-check-in-config_sortlist-to-avoid-stack-.patch
+BuildRequires: cmake
-Patch3: 0004-Merge-pull-request-from-GHSA-9g78-jv2r-p7vc.patch
+%else
 Patch4: 0005-avoid-read-heap-buffer-overflow-332.patch
 Patch5: 0006-Merge-pull-request-from-GHSA-x6mf-cxr9-8q6v.patch
 Patch6: 0007-Merge-pull-request-from-GHSA-mg26-v6qh-x48q.patch
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires: autoconf
 BuildRequires: automake
 BuildRequires: libtool
 %endif
 BuildRequires: make
 %description
 c-ares is a C library that performs DNS requests and name resolves
@ -29,81 +27,160 @@ by Greg Hudson at MIT.
 %package devel
 Summary: Development files for c-ares
-Group: Development/Libraries
+Requires: %{name}%{?_isa} = %{version}-%{release}
 Requires: %{name} = %{version}-%{release}
 Requires: pkgconfig
 %description devel
 This package contains the header files and libraries needed to
 compile applications or shared objects that use c-ares.
 %prep
-%setup -q
+%autosetup -p1
 %patch0 -p1 -b .optflags
 %patch1 -p1 -b .dns
 %patch2 -p1 -b .sortlist
 %patch3 -p1 -b .udp
 %patch4 -p1 -b .buffer
 %patch5 -p1 -b .underwrite
 %patch6 -p1 -b .bounds
 cp %{SOURCE1} .
 f=CHANGES ; iconv -f iso-8859-1 -t utf-8 $f -o $f.utf8 ; mv $f.utf8 $f
 %build
 # autoreconf -if
 # %%configure --enable-shared --disable-static \
 #            --disable-dependency-tracking
 %if %{use_cmake}
 %{cmake} -DCARES_BUILD_TOOLS:BOOL=OFF
 %cmake_build
 %else
 autoreconf -if
 %configure --enable-shared --disable-static \
           --disable-dependency-tracking
 %{__make} %{?_smp_mflags}
 %endif
 %install
-rm -rf $RPM_BUILD_ROOT
+%if %{use_cmake}
-make DESTDIR=$RPM_BUILD_ROOT install
+%cmake_install
 %else
 %make_install
 rm -f $RPM_BUILD_ROOT/%{_libdir}/libcares.la
 %endif
-%clean
+%ldconfig_scriptlets
 rm -rf $RPM_BUILD_ROOT
 %post -p /sbin/ldconfig
 %postun -p /sbin/ldconfig
 %files
-%defattr(-, root, root)
+%license LICENSE.md
-%doc README.cares CHANGES NEWS LICENSE
+%doc README.md RELEASE-NOTES.md
 %{_libdir}/*.so.*
 %files devel
 %defattr(-, root, root, 0755)
 %{_includedir}/ares.h
 %{_includedir}/ares_build.h
 %{_includedir}/ares_dns.h
-%{_includedir}/ares_rules.h
+%{_includedir}/ares_dns_record.h
 %{_includedir}/ares_nameser.h
 # %%{_includedir}/ares_rules.h
 %{_includedir}/ares_version.h
 %{_libdir}/*.so
 %if %{use_cmake}
 %{_libdir}/cmake/c-ares/
 %endif
 %{_libdir}/pkgconfig/libcares.pc
 %{_mandir}/man3/ares_*
 %changelog
-* Tue Mar 12 2024 Alexey Tikhonov <atikhono@redhat.com> - 1.13.0-11
+* Fri Jul 10 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.34.6-2
- Resolves: RHEL-26525 - c-ares: Out of bounds read in ares__read_line() [rhel-8]
+- Fix double-free in process_timeouts() (CVE-2026-33630)
  Resolves: RHEL-192867
-* Wed Oct  4 2023 Alexey Tikhonov <atikhono@redhat.com> - 1.13.0-10
+* Tue Dec 09 2025 Alejandro López <allopez@redhat.com> - 1.34.6-1
- Resolves: RHEL-7853 - Buffer Underwrite in ares_inet_net_pton() [rhel-8]
+- Update to 1.34.6
  Resolves: RHEL-103761
-* Fri Sep  8 2023 Alexey Tikhonov <atikhono@redhat.com> - 1.13.0-9
+* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 1.25.0-6
- Resolves: rhbz#2235805 - read-heap-buffer-overflow in ares_parse_soa_reply [rhel-8]
+- Bump release for October 2024 mass rebuild:
  Resolves: RHEL-64018
-* Mon May 29 2023 Alexey Tikhonov <atikhono@redhat.com> - 1.13.0-8
+* Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 1.25.0-5
- Resolves: rhbz#2209517 - CVE-2023-32067 c-ares: 0-byte UDP payload Denial of Service [rhel-8.9.0]
+- Bump release for June 2024 mass rebuild
-* Fri May 12 2023 Alexey Tikhonov <atikhono@redhat.com> - 1.13.0-7
+* Tue Mar 26 2024 Alexey Tikhonov <atikhono@redhat.com> - 1.25.0-4
- Resolves: rhbz#2170867 - c-ares: buffer overflow in config_sortlist() due to missing string length check [rhel-8]
+- Resolves: RHEL-30025 - Out of bounds read in ares__read_line() [rhel-10.0]
-* Fri Oct 15 2021 Alexey Tikhonov <atikhono@redhat.com> - 1.13.0-6
+* Tue Jan 23 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.25.0-3
- Resolves: rhbz#1989425 - CVE-2021-3672 c-ares: missing input validation of host names may lead to Domain Hijacking [rhel-8]
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-* Mon Aug 13 2018 Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-5
+* Fri Jan 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.25.0-2
- Drop an unused patch
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
 * Wed Jan 10 2024 Tom Callaway <spot@fedoraproject.org> - 1.25.0-1
 - update to 1.25.0
 * Tue Nov 21 2023 Tom Callaway <spot@fedoraproject.org> - 1.22.1-1
 - update to 1.22.1
 * Sun Nov  5 2023 Tom Callaway <spot@fedoraproject.org> - 1.21.0-1
 - update to 1.21.0
 * Wed May 24 2023 Tom Callaway <spot@fedoraproject.org> - 1.19.1-1
 - update to 1.19.1
 - fixes CVE-2023-32067
 * Fri Feb 17 2023 Tom Callaway <spot@fedoraproject.org> - 1.19.0-1
 - update to 1.19.0
 - fixes CVE-2022-4904
 * Wed Jan 18 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.17.2-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
 * Wed Jul 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.17.2-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
 * Wed Jan 19 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.17.2-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
 * Mon Aug 16 2021 Tom Callaway <spot@fedoraproject.org> - 1.17.2-1
 - update to 1.17.2
 - fixes multiple security issues including CVE-2021-3672
 * Wed Jul 21 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.17.1-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
 * Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.17.1-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
 * Fri Nov 20 2020 Tom Callaway <spot@fedoraproject.org> - 1.17.1-1
 - update to 1.17.1
 * Tue Nov 17 2020 Tom Callaway <spot@fedoraproject.org> - 1.17.0-1
 - update to 1.17.0
 * Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.16.1-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
 * Mon Jul 13 2020 Tom Stellard <tstellar@redhat.com> - 1.16.1-2
 - Use make macros
 - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
 * Mon May 11 2020 Tom Callaway <spot@fedoraproject.org> - 1.16.1-1
 - update to 1.16.1
 * Fri Mar 13 2020 Tom Callaway <spot@fedoraproject.org> - 1.16.0-1
 - update to 1.16.0
 * Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.15.0-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
 * Wed Jul 24 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.15.0-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
 * Tue Mar 12 2019 Tom Callaway <spot@fedoraproject.org> - 1.15.0-3
 - use cmake to build so we get cmake helpers (bz1687844)
 * Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.15.0-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
 * Tue Nov 13 2018 Jakub Hrozek <jhrozek@redhat.com> - 1.16.0-1
 - Update to the latest upstream
 * Mon Sep  3 2018 Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-1
 - Update to the latest upstream
 - Resolves: rhbz#1624499 - RFE: New c-ares release 1.14.0 available
 * Thu Jul 12 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.13.0-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
 * Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.13.0-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
--- a/gating.yaml
+++ b/gating.yaml
@ -1,7 +0,0 @@
 # recipients: sssd-qe
 --- !Policy
 product_versions:
  - rhel-8
 decision_context: osci_compose_gate
 rules:
  - !PassingTestCaseRule {test_case_name: idm-ci.brew-build.tier0.revdep}
--- a/2
+++ b/2
@ -1 +1 @@
-SHA512 (c-ares-1.13.0.tar.gz) = 4a7942e754673f5b8d55a7471e31b0f390e8324b14c12077580c956147fad4d165c7fe8a3190199b1add95c710ceeb1a7957706d4f0d6299d39c5dddc719bd9d
+SHA512 (c-ares-1.34.6.tar.gz) = 826eecdb40942caf75da982b9ca57fbe7c3e7c23af43a908683c7c1523c46b06ebac68405c26db8bf4c8b0774ca415666866249a3bde663a71c278f4ec7b1827
`@ -1,2 +1 @@`
	`SOURCES/c-ares-1.13.0.tar.gz`	`c-ares-1.34.6.tar.gz`
	`/c-ares-1.13.0.tar.gz`
`@ -1 +1 @@`
	`SHA512 (c-ares-1.13.0.tar.gz) = 4a7942e754673f5b8d55a7471e31b0f390e8324b14c12077580c956147fad4d165c7fe8a3190199b1add95c710ceeb1a7957706d4f0d6299d39c5dddc719bd9d`	`SHA512 (c-ares-1.34.6.tar.gz) = 826eecdb40942caf75da982b9ca57fbe7c3e7c23af43a908683c7c1523c46b06ebac68405c26db8bf4c8b0774ca415666866249a3bde663a71c278f4ec7b1827`