diff mbox series

[v3] nss: Use reallocarray to prevent integer overflow in getaddrinfo (bug 33977)

Message ID 20260624160228.2074235-2-h-glibcdev@crystaldown.de (mailing list archive)
State Failed CI
Headers
Series [v3] nss: Use reallocarray to prevent integer overflow in getaddrinfo (bug 33977) |

Checks

Context Check Description
redhat-pt-bot/TryBot-apply_patch success Patch applied to master at the time it was sent
redhat-pt-bot/TryBot-32bit fail Patch caused testsuite regressions
linaro-tcwg-bot/tcwg_glibc_build--master-aarch64 success Build passed
linaro-tcwg-bot/tcwg_glibc_build--master-arm success Build passed

Commit Message

Marcus Poller June 24, 2026, 4 p.m. UTC 
  replacing realloc by reallocarray introduces a basic overflow check.
(old + count) might still overflow, but since the NSS backend is trusted,
we do not consider this to be a valid case.
---
v1: https://inbox.sourceware.org/libc-alpha/77a01db3-5619-48b8-9682-85f11cc472bc@crystaldown.de/
v2: iterated on Arjuns and Andreas review comments
v3: re-submission to support existing tooling
---
 nss/getaddrinfo.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Arjun Shankar June 24, 2026, 5:07 p.m. UTC | #1 
> replacing realloc by reallocarray introduces a basic overflow check.
> (old + count) might still overflow, but since the NSS backend is trusted,
> we do not consider this to be a valid case.

Thanks! This looks good to me.

Reviewed-by: Arjun Shankar <arjun@redhat.com>

> ---
> v1: https://inbox.sourceware.org/libc-alpha/77a01db3-5619-48b8-9682-85f11cc472bc@crystaldown.de/
> v2: iterated on Arjuns and Andreas review comments
> v3: re-submission to support existing tooling
> ---
>  nss/getaddrinfo.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/nss/getaddrinfo.c b/nss/getaddrinfo.c
> index 4f6ac3358a..b6ac0b2dcc 100644
> --- a/nss/getaddrinfo.c
> +++ b/nss/getaddrinfo.c
> @@ -234,7 +234,7 @@ convert_hostent_to_gaih_addrtuple (const struct addrinfo *req, int family,
>        array = array->next;
>      }
>
> -  array = realloc (res->at, (old + count) * sizeof (*array));
> +  array = reallocarray (res->at, old + count, sizeof (*array));
>
>    if (array == NULL)
>      return false;
> --
> 2.47.3
>
Adhemerval Zanella June 25, 2026, 1:22 p.m. UTC | #2 
On 24/06/26 13:00, Marcus Poller wrote:
> replacing realloc by reallocarray introduces a basic overflow check.
> (old + count) might still overflow, but since the NSS backend is trusted,
> we do not consider this to be a valid case.
> ---
> v1: https://inbox.sourceware.org/libc-alpha/77a01db3-5619-48b8-9682-85f11cc472bc@crystaldown.de/
> v2: iterated on Arjuns and Andreas review comments
> v3: re-submission to support existing tooling

Unfortunately this patch has triggered some regressions [1]. But it should be
to fix, just use __libc_reallocarray instead of reallocarray.

[1] https://www.delorie.com/trybots/32bit/62685/

> ---
>  nss/getaddrinfo.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/nss/getaddrinfo.c b/nss/getaddrinfo.c
> index 4f6ac3358a..b6ac0b2dcc 100644
> --- a/nss/getaddrinfo.c
> +++ b/nss/getaddrinfo.c
> @@ -234,7 +234,7 @@ convert_hostent_to_gaih_addrtuple (const struct addrinfo *req, int family,
>        array = array->next;
>      }
>  
> -  array = realloc (res->at, (old + count) * sizeof (*array));
> +  array = reallocarray (res->at, old + count, sizeof (*array));
>  
>    if (array == NULL)
>      return false;
Arjun Shankar June 26, 2026, 8:32 a.m. UTC | #3 
Hi Marcus,

On Thu, Jun 25, 2026 at 3:23 PM Adhemerval Zanella Netto
<adhemerval.zanella@linaro.org> wrote:
> Unfortunately this patch has triggered some regressions [1]. But it should be
> to fix, just use __libc_reallocarray instead of reallocarray.
>
> [1] https://www.delorie.com/trybots/32bit/62685/

I haven't pushed this yet. Please post a v4.

Thanks!
Arjun
diff mbox series

Patch

diff --git a/nss/getaddrinfo.c b/nss/getaddrinfo.c
index 4f6ac3358a..b6ac0b2dcc 100644
--- a/nss/getaddrinfo.c
+++ b/nss/getaddrinfo.c
@@ -234,7 +234,7 @@  convert_hostent_to_gaih_addrtuple (const struct addrinfo *req, int family,
       array = array->next;
     }
 
-  array = realloc (res->at, (old + count) * sizeof (*array));
+  array = reallocarray (res->at, old + count, sizeof (*array));
 
   if (array == NULL)
     return false;