From patchwork Fri Jul 3 14:53:02 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Weimer X-Patchwork-Id: 138441 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 22B754BA23DB for ; Fri, 3 Jul 2026 14:59:16 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 22B754BA23DB Authentication-Results: sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=ZvCR37mP X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by sourceware.org (Postfix) with ESMTP id 443FE4BA23DB for ; Fri, 3 Jul 2026 14:53:08 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 443FE4BA23DB Authentication-Results: sourceware.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 443FE4BA23DB Authentication-Results: sourceware.org; arc=none smtp.remote-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1783090388; cv=none; b=oAPF0eWcBDmd9rruMqCHpumKQjIXgRMQKsbaBXEyY3hg5YgH3EvvEa14/7jN4NAXPewL5XAzSlASx2wrmf46GTiajZWL+DBiDVb8+7/VwoYjlZWq/CM6LhdCuHyOJ228iN/oEKOpUMk9kFhrunopzAJz+0OtpVViXDvExANlM+8= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1783090388; c=relaxed/simple; bh=/WQv/nSPPhF2pfCYBtNPrN8jOzh337OZcGxFkCQGRHQ=; h=DKIM-Signature:From:To:Subject:Message-ID:Date:MIME-Version; b=OQ+Aq1D5Z+jEyEFnc3YqovWKtLtBkSfJ6wMr1L4DHNV5N0fU4JwwGISJ2FXMxXUPATDkCcLPJ8yMsczARWOULNeDLxF5iR13VHpyF62zrTI2CubwVvQ/CgQFvW1ik5Y7cNFDYTnZ00r8+iwXVadXzwnJd07Jg0Zy0FmgFHCxRos= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=ZvCR37mP DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 443FE4BA23DB DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1783090387; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=DJ+dTDT+I1/wzW371NFeF7J1P9Zgtr9EeJW4yH4v55Q=; b=ZvCR37mPhW1PmL/97v/DGh33J7ggt2fGYx+sK4jb4T5e46yYftlU7ZScMoidmypL7qlivh O0FVcZPlmMo1X6xAX+Mb25xgZmVHZdnWO1JCaYhOHxVTUWhDFR58ZrCKI3o8VwVKVd96cG QK8gxKqV2qj36KpmurCv5GypoPb8rG0= Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-384-xF3iBjH2PDCGvlvlNrooyA-1; Fri, 03 Jul 2026 10:53:06 -0400 X-MC-Unique: xF3iBjH2PDCGvlvlNrooyA-1 X-Mimecast-MFC-AGG-ID: xF3iBjH2PDCGvlvlNrooyA_1783090386 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id DA28D1935DEE for ; Fri, 3 Jul 2026 14:53:05 +0000 (UTC) Received: from oldenburg3.str.redhat.com (unknown [10.44.50.50]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 30D9F1800613 for ; Fri, 3 Jul 2026 14:53:04 +0000 (UTC) From: Florian Weimer To: libc-alpha@sourceware.org Subject: [PATCH 3/4] resolv: Fix __libc_res_queriesmatch buffer size argument in send_dg (bug 34346) In-Reply-To: Message-ID: <99ad4d202644810ba322af9edec713f60f23fb3e.1783089265.git.fweimer@redhat.com> References: X-From-Line: 99ad4d202644810ba322af9edec713f60f23fb3e Mon Sep 17 00:00:00 2001 Date: Fri, 03 Jul 2026 16:53:02 +0200 User-Agent: Gnus/5.13 (Gnus v5.13) MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: tz5cfYMHaQleSwz-gfFczfq1HDfFvKsnKlEAMrmKv68_1783090386 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-9.5 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL, RCVD_IN_SBL_CSS, SPF_HELO_PASS, SPF_NONE, TXREP shortcircuit=no autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces~patchwork=sourceware.org@sourceware.org Pass the number of bytes written by recvfrom, not the entire size of the buffer. This is not a security vulnerability because it only allows confirmation of previously existing buffer values. All reads stay within the specified buffer bounds. The buffer contents may not have been initialized. Subsequent processing is correctly capped at buffer bounds, too. Reviewed-by: Adhemerval Zanella --- resolv/res_send.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/resolv/res_send.c b/resolv/res_send.c index cf27fa7ad6..cc65a03e7d 100644 --- a/resolv/res_send.c +++ b/resolv/res_send.c @@ -1215,14 +1215,14 @@ send_dg(res_state statp, && (skip_query_match || __libc_res_queriesmatch (buf, buf + buflen, *thisansp, - *thisansp + *thisanssizp))) + *thisansp + *thisresplenp))) matching_query = 1; if (!recvresp2 && anhp->id == hp2->id && (skip_query_match || __libc_res_queriesmatch (buf2, buf2 + buflen2, *thisansp, - *thisansp + *thisanssizp))) + *thisansp + *thisresplenp))) matching_query = 2; if (matching_query == 0) /* Spurious UDP packet. Drop it and continue