glibc/glibc-RHEL-180336-4.patch
DJ Delorie 1d22b956dd CVE-2026-5435 Out-of-bounds write via TSIG record processing
Resolves: RHEL-180336
Resolves: RHEL-185614
2026-07-07 12:54:03 +00:00

64 lines
2.0 KiB
Diff

commit cd0db208d56a2cecd528b8ae96df752ba5344d9a
Author: Florian Weimer <fweimer@redhat.com>
Date: Fri Jun 19 18:22:20 2026 +0200
resolv: Check for inet_ntop failure in ns_sprintrrf
This makes the output more consistent (either failure or complete
output) and helps with systematic testing with varying buffer
sizes.
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
diff --git a/resolv/ns_print.c b/resolv/ns_print.c
index 3d38876483..e58df5f35a 100644
--- a/resolv/ns_print.c
+++ b/resolv/ns_print.c
@@ -167,8 +167,9 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
switch (type) {
case ns_t_a:
if (rdlen != (size_t)NS_INADDRSZ)
- goto formerr;
- (void) inet_ntop(AF_INET, rdata, buf, buflen);
+ goto formerr;
+ if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL)
+ return -1;
addlen(strlen(buf), &buf, &buflen);
break;
@@ -334,9 +335,10 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
}
case ns_t_aaaa:
- if (rdlen != (size_t)NS_IN6ADDRSZ)
- goto formerr;
- (void) inet_ntop(AF_INET6, rdata, buf, buflen);
+ if (rdlen != (size_t)NS_IN6ADDRSZ)
+ goto formerr;
+ if (inet_ntop (AF_INET6, rdata, buf, buflen) == NULL)
+ return -1;
addlen(strlen(buf), &buf, &buflen);
break;
@@ -427,7 +429,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
goto formerr;
/* Address. */
- (void) inet_ntop(AF_INET, rdata, buf, buflen);
+ if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL)
+ return -1;
addlen(strlen(buf), &buf, &buflen);
rdata += NS_INADDRSZ;
@@ -569,7 +572,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
if (rdata + pbyte >= edata) goto formerr;
memset(&a, 0, sizeof(a));
memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte);
- (void) inet_ntop(AF_INET6, &a, buf, buflen);
+ if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL)
+ return -1;
addlen(strlen(buf), &buf, &buflen);
rdata += sizeof(a) - pbyte;
}