[v4.] nss: Use reallocarray to prevent integer overflow in getaddrinfo (bug 33977)
Checks
| Context |
Check |
Description |
| redhat-pt-bot/TryBot-apply_patch |
success
|
Patch applied to master at the time it was sent
|
| redhat-pt-bot/TryBot-32bit |
success
|
Build for i686
|
| linaro-tcwg-bot/tcwg_glibc_build--master-arm |
success
|
Build passed
|
| linaro-tcwg-bot/tcwg_glibc_build--master-aarch64 |
success
|
Build passed
|
| linaro-tcwg-bot/tcwg_glibc_check--master-aarch64 |
fail
|
Test failed
|
| linaro-tcwg-bot/tcwg_glibc_check--master-arm |
success
|
Test passed
|
Commit Message
replacing realloc by reallocarray introduces a basic overflow check.
(old + count) might still overflow, but since the NSS backend is trusted,
we do not consider this to be a valid case.
---
v1: https://inbox.sourceware.org/libc-alpha/77a01db3-5619-48b8-9682-85f11cc472bc@crystaldown.de/
v2: iterated on Arjuns and Andreas review comments
v3: re-submission to support existing tooling
v4: moved from reallocarray to __libc_reallocarray due to a regression found by Adhemerval
---
nss/getaddrinfo.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Comments
OK for the release with a R-B
Am Montag, 6. Juli 2026, 17:37:32 Japanische Normalzeit schrieb Marcus Poller:
> replacing realloc by reallocarray introduces a basic overflow check.
> (old + count) might still overflow, but since the NSS backend is trusted,
> we do not consider this to be a valid case.
> ---
> v1: https://inbox.sourceware.org/libc-alpha/77a01db3-5619-48b8-9682-85f11cc472bc@crystaldown.de/
> v2: iterated on Arjuns and Andreas review comments
> v3: re-submission to support existing tooling
> v4: moved from reallocarray to __libc_reallocarray due to a regression found by Adhemerval
> ---
> nss/getaddrinfo.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/nss/getaddrinfo.c b/nss/getaddrinfo.c
> index 4f6ac3358a..45b7f728a1 100644
> --- a/nss/getaddrinfo.c
> +++ b/nss/getaddrinfo.c
> @@ -234,7 +234,7 @@ convert_hostent_to_gaih_addrtuple (const struct addrinfo *req, int family,
> array = array->next;
> }
>
> - array = realloc (res->at, (old + count) * sizeof (*array));
> + array = __libc_reallocarray (res->at, old + count, sizeof (*array));
>
> if (array == NULL)
> return false;
>
@@ -234,7 +234,7 @@ convert_hostent_to_gaih_addrtuple (const struct addrinfo *req, int family,
array = array->next;
}
- array = realloc (res->at, (old + count) * sizeof (*array));
+ array = __libc_reallocarray (res->at, old + count, sizeof (*array));
if (array == NULL)
return false;