glibc/glibc-RHEL-180336-3.patch
DJ Delorie 1d22b956dd CVE-2026-5435 Out-of-bounds write via TSIG record processing
Resolves: RHEL-180336
Resolves: RHEL-185614
2026-07-07 12:54:03 +00:00

49 lines
1.3 KiB
Diff

commit d58415eb17d457a160af99f9e8ab164404ca151b
Author: Florian Weimer <fweimer@redhat.com>
Date: Fri Jun 19 18:22:20 2026 +0200
resolv: Improve formatting of unknown records in ns_sprintrrf
Do not add the "unknown RR type" comment. After adding the TYPE
prefix, the number is largely redundant.
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
diff --git a/resolv/ns_print.c b/resolv/ns_print.c
index e75c39eaa8..3d38876483 100644
--- a/resolv/ns_print.c
+++ b/resolv/ns_print.c
@@ -115,7 +115,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
const char *comment;
char tmp[100];
- char errbuf[40];
int len, x;
/*
@@ -590,20 +589,18 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
T(addstr(tmp, len, &buf, &buflen));
break;
}
-
default:
- snprintf (errbuf, sizeof (errbuf), "unknown RR type %d", type);
- comment = errbuf;
+ comment = "";
goto hexify;
}
return (buf - obuf);
formerr:
- comment = "RR format error";
+ comment = " ; RR format error";
hexify: {
int n, m;
char *p;
- len = SPRINTF((tmp, "\\# %u%s\t; %s", (unsigned)(edata - rdata),
+ len = SPRINTF((tmp, "\\# %u%s%s", (unsigned)(edata - rdata),
rdlen != 0U ? " (" : "", comment));
T(addstr(tmp, len, &buf, &buflen));
while (rdata < edata) {