Red Hat Bugzilla – Bug 1223095
access to uninitialized memory in getaddrinfo if nscd is running
Last modified: 2017-03-21 06:34:44 EDT
The problem also happens in rhel-7.x. Checking in rhel-7, the memory is allocated at: sysdeps/posix/getaddrinfo.c:706 if (__libc_use_alloca (alloca_used + air->naddrs * sizeof (struct gaih_addrtuple))) addrmem = alloca_account (air->naddrs * sizeof (struct gaih_addrtuple), alloca_used); Simple debug attaching gdb from valgrind: ==30081== Conditional jump or move depends on uninitialised value(s) ==30081== at 0x4F10C22: gaih_inet (getaddrinfo.c:1200) ==30081== by 0x4F147AC: getaddrinfo (getaddrinfo.c:2420) ==30081== by 0x4005C8: main (gaitest.c:10) ... (gdb) bt #0 gaih_inet (name=name@entry=0x400660 "localhost", service=<optimized out>, req=req@entry=0xffefffd30, pai=0x51f62a8, pai@entry=0xffefffbe0, naddrs=naddrs@entry=0xffefffbd0) at ../sysdeps/posix/getaddrinfo.c:1200 #1 0x0000000004f147ad in __GI_getaddrinfo (name=0x400660 "localhost", service=0x0, hints=0xffefffd30, pai=0xffefffd68) at ../sysdeps/posix/getaddrinfo.c:2420 #2 0x00000000004005c9 in main () at gaitest.c:10 (gdb) p addrmem $1 = (struct gaih_addrtuple *) 0xffefff8b0 (gdb) p at->next $2 = (struct gaih_addrtuple *) 0xffefff8b0 (gdb) p* at->next $3 = {next = 0x0, name = 0x0, family = -16778416, addr = {15, 0, 0, 0}, scopeid = 0} (gdb) p* req $4 = {ai_flags = 2, ai_family = 2, ai_socktype = 0, ai_protocol = 0, ai_addrlen = 0, ai_addr = 0x0, ai_canonname = 0x0, ai_next = 0x0} (gdb) p $rsp $5 = (void *) 0xffefff890
Created attachment 1027400 [details] gaitest.c Test case. strace will show random values, like this: connect(3, {sa_family=XXX /* AF_??? */, sa_data="\0\0\377\177\0\0\0\0\0\0\0\0\0\0"}, 16) = -1 EAFNOSUPPORT (Address family not supported by protocol) where XXX is some random value. Valgrind will tell all sorts of uninitialized memory use.
Moving this to rhel-6.8 since we're outside the rhel-6.7 development window. We'll have to look at this more carefully and decide how to fix it.
I can confirm that the upstream fix addresses this issue: commit a071766ebfd853179ac39f9773f894029bf86d36 Author: Andreas Schwab <schwab@suse.de> Date: Thu Mar 20 15:05:25 2014 +0100 Fix use of half-initialized result in getaddrinfo when using nscd (bug 16743) This fixes a bug in the way the results from __nscd_getai are collected: for every returned result a new entry is first added to the gaih_addrtuple list, but if that result doesn't match the request this entry remains uninitialized. So for this non-matching result an extra result with uninitialized content is returned. To reproduce (with nscd running): $ getent ahostsv4 localhost 127.0.0.1 STREAM localhost 127.0.0.1 DGRAM 127.0.0.1 RAW (null) STREAM (null) DGRAM (null) RAW https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=a071766ebfd853179ac39f9773f894029bf86d36
This bug was accidentally moved from POST to MODIFIED via an error in automation, please see mmccune@redhat.com with any questions
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2017-0680.html