musl - gethostbyname buffer overflow (glibc)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAPLrYES9oEF5XB32Q8tDxYuDJ8wOZ6iiZEQz3vxbun2vtqrYuQ@mail.gmail.com>
Date: Tue, 27 Jan 2015 17:59:36 +0100
From: Daniel Cegiełka <daniel.cegielka@...il.com>
To: musl@...ts.openwall.com
Subject: gethostbyname buffer overflow (glibc)

eg from:

http://www.openwall.com/lists/oss-security/2015/01/27/9

# gcc ghost.c && ./a.out
should not happen


  retval = gethostbyname_r(name, &resbuf, temp.buffer,
sizeof(temp.buffer), &result, &herrno);

  if (strcmp(temp.canary, CANARY) != 0) {
    puts("vulnerable");
    exit(EXIT_SUCCESS);
  }
  if (retval == ERANGE) {
    puts("not vulnerable");
    exit(EXIT_SUCCESS);
  }
  puts("should not happen");
  exit(EXIT_FAILURE);

Double exit. Is something wrong with gethostbyname_r() in musl?

Daniel

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.