b333c27787
Relevant commits already backported; skipped from this sync: - elf: handle addition overflow in _dl_find_object_update_1 [BZ #32245] (glibc-RHEL-119398.patch) - Avoid uninitialized result in sem_open when file does not exist (glibc-RHEL-119392-1.patch) - Rename new tst-sem17 test to tst-sem18 (glibc-RHEL-119392-2.patch) - nss: Group merge does not react to ERANGE during merge (bug 33361) (glibc-RHEL-114265.patch) - AArch64: Fix instability in AdvSIMD tan (glibc-RHEL-118273-44.patch) RPM-Changelog: - Sync with upstream branch release/2.39/master (RHEL-126766) - Upstream commit: ce65d944e38a20cb70af2a48a4b8aa5d8fabe1cc - posix: Reset wordexp_t fields with WRDE_REUSE (CVE-2025-15281 / BZ 33814) - resolv: Fix NSS DNS backend for getnetbyaddr (CVE-2026-0915) - memalign: reinstate alignment overflow check (CVE-2026-0861) - support: Exit on consistency check failure in resolv_response_add_name - support: Fix FILE * leak in check_for_unshare_hints in test-container - sprof: fix -Wformat warnings on 32-bit hosts - sprof: check pread size and offset for overflow - getaddrinfo.c: Avoid uninitialized pointer access [BZ #32465] - nptl: Optimize trylock for high cache contention workloads (BZ #33704) - ppc64le: Power 10 rawmemchr clobbers v20 (bug #33091) - ppc64le: Restore optimized strncmp for power10 - ppc64le: Restore optimized strcmp for power10 - AArch64: Optimise SVE scalar callbacks - aarch64: fix includes in SME tests - aarch64: fix cfi directives around __libc_arm_za_disable - aarch64: tests for SME - aarch64: clear ZA state of SME before clone and clone3 syscalls - aarch64: define macro for calling __libc_arm_za_disable - aarch64: update tests for SME - aarch64: Disable ZA state of SME in setjmp and sigsetjmp - linux: Also check pkey_get for ENOSYS on tst-pkey (BZ 31996) - aarch64: Do not link conform tests with -Wl,-z,force-bti (bug 33601) - x86: fix wmemset ifunc stray '!' (bug 33542) - x86: Detect Intel Nova Lake Processor - x86: Detect Intel Wildcat Lake Processor Resolves: RHEL-126766 Resolves: RHEL-45143 Resolves: RHEL-45145 Resolves: RHEL-142786 Resolves: RHEL-141852 Resolves: RHEL-141733
28 lines
1.1 KiB
Diff
28 lines
1.1 KiB
Diff
commit 10c0bcb3d3935f9b79a828502513c2084c90772c
|
|
Author: Florian Weimer <fweimer@redhat.com>
|
|
Date: Thu Nov 6 14:49:21 2025 +0100
|
|
|
|
support: Exit on consistency check failure in resolv_response_add_name
|
|
|
|
Using TEST_VERIFY (crname_target != crname) instructs some analysis
|
|
tools that crname_target == crname might hold. Under this assumption,
|
|
they report a use-after-free for crname_target->offset below, caused
|
|
by the previous free (crname).
|
|
|
|
Reviewed-by: Collin Funk <collin.funk1@gmail.com>
|
|
(cherry picked from commit b64335ff111c071fde61aec1c1a8460afb3d16d4)
|
|
|
|
diff --git a/support/resolv_test.c b/support/resolv_test.c
|
|
index f1613bd255c086e1..d4cc26b4aa24ce3a 100644
|
|
--- a/support/resolv_test.c
|
|
+++ b/support/resolv_test.c
|
|
@@ -326,7 +326,7 @@ resolv_response_add_name (struct resolv_response_builder *b,
|
|
crname_target = *ptr;
|
|
else
|
|
crname_target = NULL;
|
|
- TEST_VERIFY (crname_target != crname);
|
|
+ TEST_VERIFY_EXIT (crname_target != crname);
|
|
/* Not added to the tree. */
|
|
free (crname);
|
|
}
|