diff mbox series

[2/4] resolv: Handle ternary return value in __libc_res_queriesmatch (bug 34345)

Message ID f2a05fdecf84b81dbb13d1b05c991b2aff8e1c86.1783089265.git.fweimer@redhat.com (mailing list archive)
State New
Headers
Series resolv: Fixing slight buffer misuse in send_dg |

Checks

Context Check Description
redhat-pt-bot/TryBot-apply_patch success Patch applied to master at the time it was sent
linaro-tcwg-bot/tcwg_glibc_build--master-arm success Build passed
linaro-tcwg-bot/tcwg_glibc_build--master-aarch64 success Build passed
linaro-tcwg-bot/tcwg_glibc_check--master-aarch64 fail Test failed
linaro-tcwg-bot/tcwg_glibc_check--master-arm success Test passed

Commit Message

Florian Weimer July 3, 2026, 2:52 p.m. UTC 
  The __libc_res_nameinquery function returns -1 for corrupted packets.
The previous code treated those as matching.

This is not a security vulnerability because the transaction ID is
still checked.  The bug does not  make off-path attacks substantially
easier.  Furthermore, most users of the DNS stub resolver parse the
question name again, and do not simply skip over it using dn_skipname
or similar (which would hide the corruption).  This means that the
packet is still rejected at a later stage.
---
 resolv/res_queriesmatch.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/resolv/res_queriesmatch.c b/resolv/res_queriesmatch.c
index 08d82f1814..a11d0b4fc7 100644
--- a/resolv/res_queriesmatch.c
+++ b/resolv/res_queriesmatch.c
@@ -122,7 +122,8 @@  __libc_res_queriesmatch (const unsigned char *buf1, const unsigned char *eom1,
         return -1;
       NS_GET16 (ttype, cp);
       NS_GET16 (tclass, cp);
-      if (!__libc_res_nameinquery (tname, ttype, tclass, buf2, eom2))
+      if (__libc_res_nameinquery (tname, ttype, tclass, buf2, eom2) <= 0)
+        /* Parse error or mismatch.  */
         return 0;
     }
   return 1;