| Anonymous | Login | Signup for a new account | 11-10-2008 11:18 PST |
| Main | My View | View Issues | Change Log | Docs |
| Viewing Issue Simple Details [ Jump to Notes ] | [ View Advanced ] [ Issue History ] [ Print ] | |||||||||||
| ID | Category | Severity | Reproducibility | Date Submitted | Last Update | |||||||
| 0001468 | [uClibc] Networking Support | major | always | 08-21-07 04:03 | 11-01-08 17:26 | |||||||
| Reporter | vvv | View Status | public | |||||||||
| Assigned To | uClibc | |||||||||||
| Priority | normal | Resolution | open | |||||||||
| Status | assigned | Product Version | ||||||||||
| Summary | 0001468: Couple more bugs in gethostbyname() (patch attached) | |||||||||||
| Description |
The following bugs have been observed in gethostbyname(): 1. gethostbyname() fails if DNS server returns more than 23 addresses (reported by me as 0001361) 2. gethostbyname() fails if the response from DNS server is truncated (i.e. the full response would contain more than 512 bytes). Such situation existed for a couple days for vpn.corbina.net - DNS was returning 29 addresses. 3. The h_aliases[0] field of struct hostent points to a corrupted buffer (the buffer is always overwritten by h_addr_list[0]). The attached patch fixes the issue for uClibc-0.9.29. Note: this patch makes my fixes of 0001361 redundant. |
|||||||||||
| Additional Information | ||||||||||||
| Attached Files |
|
|||||||||||
|
|
||||||||||||
Relationships |
||||||
|
||||||
Notes |
|
|
(0014814) vda 11-01-08 16:37 |
I committed some of your fixes. The biggest part which significantly alters gethostbyname_r() is not applied, I want someone to review it first. b.patch is a patch avainst today's svn. Size: text data bss dec hex filename - 748 0 0 748 2ec libc/inet/gethostbyname_r.o + 641 0 0 641 281 libc/inet/gethostbyname_r.o Test program: #include <netdb.h> #include <sys/socket.h> #include <stdio.h> int main(int argc, char **argv) { char buf[1024]; char **h_aliases; char **h_addr_list; struct hostent *h = gethostbyname(argv[1]); if (!h) { printf("NULL! h_errno:%d (%s)\n", h_errno, hstrerror(h_errno)); return 0; } printf("h_name:'%s'\n", h->h_name); printf("h_length:%d\n", h->h_length); printf("h_addrtype: %x %s\n", h->h_addrtype, h->h_addrtype == AF_INET ? "AF_INET" : h->h_addrtype == AF_INET6 ? "AF_INET6" : "???" ); h_aliases = h->h_aliases; while (*h_aliases) printf("alias:'%s'\n", *h_aliases++); h_addr_list = h->h_addr_list; while (*h_addr_list) { printf("addr: 0x%08x '%s'\n", (int) *(uint32_t*)*h_addr_list, inet_ntop(h->h_addrtype, *h_addr_list, buf, sizeof(buf))); h_addr_list++; } return 0; } Before patch: # ./test cnn.com h_name:'cnn.com' h_length:4 h_addrtype:AF_INET alias:'²&9557;&0001041;²&9557;&0001070;&9618;²&9557;&0001041;&0001051;&9618;' addr: 0x1ae2a69d '157.166.226.26' addr: 0x19e0a69d '157.166.224.25' addr: 0x1ae0a69d '157.166.224.26' addr: 0x19e2a69d '157.166.226.25' After patch: # ./test cnn.com h_name:'cnn.com' h_length:4 h_addrtype: 2 AF_INET alias:'cnn.com' addr: 0x19e2a69d '157.166.226.25' addr: 0x1ae2a69d '157.166.226.26' addr: 0x19e0a69d '157.166.224.25' addr: 0x1ae0a69d '157.166.224.26' |
| Copyright © 2000 - 2006 Mantis Group |