musl - Error in getaddrinfo()?

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190219202700.GB19969@voyager>
Date: Tue, 19 Feb 2019 21:27:00 +0100
From: Markus Wichmann <nullplan@....net>
To: musl@...ts.openwall.com
Subject: Error in getaddrinfo()?

Hi all,

I was just reading the getaddrinfo() source code, and I noticed
something funny. On line 107 we have the wonderful text:

		out[k].slot = i;

In context, k counts through all the outputs, i counts all the addresses
and j counts the ports. I was wondering about this line and looked for
where slot might be used. Its only use is in freeaddrinfo(), where it is
used to find the head of the output array. But then the slot should be
set to k, right?

I mean, it works wonderfully in the normal use case, where you call
freeaddrinfo() with the first element of the list. It also works in all
cases if nservs == 1, which is the case if the IPPROTO is set explicitly
in the hints structure. But otherwise?

According to POSIX, freeaddrinfo() has to support freeing "arbitrary
sublists" of the list originally returned by getaddrinfo(). I presume
that means "tail", because there is no way to free only a certain middle
part of the list.

And while we're on the subject, a few lines later we get

			.ai_next = &out[k+1].ai };

Now, for the last k, isn't this calculation undefined? The array index
is out of bounds, then. It won't matter what is calculated here, since
the last .ai_next is explicitly nulled a few lines further down, but the
calculation might invoke undefined behavior, and these last few years
compilers have gotten really agressive about that.

Ciao,
Markus

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.