Bug 1320596 - glibc: NULL pointer dereference in stub resolver with unconnectable name server addresses
Summary: glibc: NULL pointer dereference in stub resolver with unconnectable name serv...
Keywords:
Status: CLOSED ERRATA
Alias: None
Deadline: 2016-03-31
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: glibc
Version: 7.3
Hardware: Unspecified
OS: Unspecified
high
medium
Target Milestone: rc
: ---
Assignee: Florian Weimer
QA Contact: Michael Petlan
URL:
Whiteboard:
Depends On: 1316972
Blocks: 1323839
TreeView+ depends on / blocked
 
Reported: 2016-03-23 15:24 UTC by Florian Weimer
Modified: 2016-11-03 08:31 UTC (History)
10 users (show)

Fixed In Version:
Doc Type: No Doc Update
Doc Text:
undefined
Clone Of: 1316972
: 1323839 (view as bug list)
Environment:
Last Closed: 2016-11-03 08:31:14 UTC
Target Upstream Version:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:2573 0 normal SHIPPED_LIVE Low: glibc security, bug fix, and enhancement update 2016-11-03 12:05:56 UTC
Sourceware 19791 0 P2 RESOLVED Assertion failure in res_query.c with un-connectable name server addresses 2019-12-19 10:50:52 UTC
Sourceware 19825 0 P2 RESOLVED resolv: send_vc can return uninitialized data in second response to getaddrinfo 2019-12-19 10:50:52 UTC
Sourceware 19830 0 P2 RESOLVED nss_dns: should check RDATA length against buffer length 2019-12-19 10:50:54 UTC
Sourceware 19831 0 P2 RESOLVED nss_dns: getaddrinfo returns uninitialized data when confronted with A/AAAA records of invalid size 2019-12-19 10:50:54 UTC

Description Florian Weimer 2016-03-23 15:24:21 UTC 
+++ This bug was initially created as a clone of Bug #1316972 +++

If /etc/resolv.conf contains addresses which cause the connect system call to fail immediately, queries which trigger search along the search path result in a segmentation fault.

A workaround is to remove the problematic addresses from /etc/resolv.conf.

--- Additional comment from Florian Weimer on 2016-03-23 16:22:08 CET ---

swbz#19825 is a very similar bug in send_vc/TCP (the original bug is about send_dg/UDP), so far only observed under valgrind.

swbz#19831 and swbz#19830 should be backported as well, to get cleaner test suite runs.
Comment 2 Florian Weimer 2016-03-31 08:23:26 UTC 
Test case for the assert/NULL pointer dereference:

  https://pagure.io/glibc-resolv-tests/blob/master/f/tst-search2.c

Alternative test: Put “nameserver 255.255.255.255” as the first name server into /etc/resolv.conf, and run “getent ahosts does-not-exist”.  You need to have non-empty search path, too (“search redhat.com”, for example).
Comment 11 Michael Petlan 2016-08-04 14:15:39 UTC 
Failed with glibc-2.17-105.el7 and passed with glibc-2.17-156.el7.

VERIFIED.
Comment 13 errata-xmlrpc 2016-11-03 08:31:14 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2016-2573.html
Note You need to log in before you can comment on or make changes to this bug.