From patchwork Fri Jul 3 14:52:55 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Weimer X-Patchwork-Id: 138437 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 38EF14BA23F8 for ; Fri, 3 Jul 2026 14:57:09 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 38EF14BA23F8 Authentication-Results: sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=WAbVQari X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by sourceware.org (Postfix) with ESMTP id AF8114BA23D3 for ; Fri, 3 Jul 2026 14:53:01 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org AF8114BA23D3 Authentication-Results: sourceware.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org AF8114BA23D3 Authentication-Results: sourceware.org; arc=none smtp.remote-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1783090381; cv=none; b=MC6T2Vv+jsg1GWtuNsptAHoYtAJDai3W1VzeTdTPTlwjpERxA4rp53YL6DsV3t2zR4uhZpwxsUVC3Kaqsh12WViXnxxRl4VzpqQGzSil5ESG+OmuWV2Z4Te2br6G7DHCvZtP3/TlTEEXjGx2ov5OL7BAc/qH+Czm+mvIQ1pkv9w= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1783090381; c=relaxed/simple; bh=RC9bAP6oAsgVSnZ7RaqvexJ0a6maodBCyl4A+F/n4KY=; h=DKIM-Signature:From:To:Subject:Message-ID:Date:MIME-Version; b=LNZZ7hMbpm1JJtn6uGuQt9lZN4R/hFyA/x9E3kxoUuUzIgUitWYILldBe0lLaS0eqfO90c+tbFTrT6fS5aRp+iiGjnl3p6eZels9ahN6a9s2ZADe6xDFSLChNifpu2OtG0c7siAM2rKO4nSA8rStyCfZk4dRGEB3NVRV0SzzneE= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=WAbVQari DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org AF8114BA23D3 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1783090381; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=gilonC3cmJw940cnlEWxXAQIvqTdC4DCXjUiW1p7kMM=; b=WAbVQariZi2yHMej+l2J8u6k9Zjs17NhV8xrfSpVNQpBf+kOYymO9xAhBwYLcDpuxijW8e Lt5wsS9/1Xdpg5vqWAoFJYAObRCyAjChUgaSAZIGRt8h8jTcZGpVt9WeqNf1mNsMRX/jQX euOKtgfgcTGkip4aw9gh9NcVF+F7MiA= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-462-LG56lwUNOA-j1XE42B4Mxw-1; Fri, 03 Jul 2026 10:53:00 -0400 X-MC-Unique: LG56lwUNOA-j1XE42B4Mxw-1 X-Mimecast-MFC-AGG-ID: LG56lwUNOA-j1XE42B4Mxw_1783090379 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 6BFB41863B25 for ; Fri, 3 Jul 2026 14:52:59 +0000 (UTC) Received: from oldenburg3.str.redhat.com (unknown [10.44.50.50]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id B810E36F2C for ; Fri, 3 Jul 2026 14:52:58 +0000 (UTC) From: Florian Weimer To: libc-alpha@sourceware.org Subject: [PATCH 2/4] resolv: Handle ternary return value in __libc_res_queriesmatch (bug 34345) In-Reply-To: Message-ID: References: X-From-Line: f2a05fdecf84b81dbb13d1b05c991b2aff8e1c86 Mon Sep 17 00:00:00 2001 Date: Fri, 03 Jul 2026 16:52:55 +0200 User-Agent: Gnus/5.13 (Gnus v5.13) MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: kJrZvMqLr9sgUJC_jfpQ9whzg2jj6du0AGmpzcvotYI_1783090379 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-10.9 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL, SPF_HELO_PASS, SPF_NONE, TXREP shortcircuit=no autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces~patchwork=sourceware.org@sourceware.org The __libc_res_nameinquery function returns -1 for corrupted packets. The previous code treated those as matching. This is not a security vulnerability because the transaction ID is still checked. The bug does not make off-path attacks substantially easier. Furthermore, most users of the DNS stub resolver parse the question name again, and do not simply skip over it using dn_skipname or similar (which would hide the corruption). This means that the packet is still rejected at a later stage. Reviewed-by: Adhemerval Zanella --- resolv/res_queriesmatch.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/resolv/res_queriesmatch.c b/resolv/res_queriesmatch.c index 08d82f1814..a11d0b4fc7 100644 --- a/resolv/res_queriesmatch.c +++ b/resolv/res_queriesmatch.c @@ -122,7 +122,8 @@ __libc_res_queriesmatch (const unsigned char *buf1, const unsigned char *eom1, return -1; NS_GET16 (ttype, cp); NS_GET16 (tclass, cp); - if (!__libc_res_nameinquery (tname, ttype, tclass, buf2, eom2)) + if (__libc_res_nameinquery (tname, ttype, tclass, buf2, eom2) <= 0) + /* Parse error or mismatch. */ return 0; } return 1;