NetBSD Problem Report #57758

From www@netbsd.org  Thu Dec  7 23:24:44 2023
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 8A66C1A9238
	for <gnats-bugs@gnats.NetBSD.org>; Thu,  7 Dec 2023 23:24:44 +0000 (UTC)
Message-Id: <20231207232443.2DA881A9239@mollari.NetBSD.org>
Date: Thu,  7 Dec 2023 23:24:43 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: resource leak in /etc/hosts gethostbyname (libc/net/sethostent.c)
X-Send-Pr-Version: www-1.0

>Number:         57758
>Category:       lib
>Synopsis:       resource leak in /etc/hosts gethostbyname (libc/net/sethostent.c)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    lib-bug-people
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Dec 07 23:25:00 +0000 2023
>Closed-Date:    Sun Dec 10 14:59:28 +0000 2023
>Last-Modified:  Sun Dec 10 14:59:28 +0000 2023
>Originator:     Taylor R Campbell
>Release:        current, 10, 9, 8
>Organization:
The NetBSD Foundation
>Environment:
>Description:
The _hf_gethtbyname2 function in src/lib/libc/net/sethostent.c, used by gethostbyname for name resolution through /etc/hosts, leaks an open stdio FILE object in some failure branches.

Reported by enh@google.com on findings by wuhaitao3 <wuhaitao3@xiaomi.corp-partner.google.com> and Chris Ferris <cferris@google.com>.
>How-To-Repeat:
Call gethostbyname with a hostname when any of the following conditions holds:

- /etc/hosts is missing
- the hostname in question has more than 35 addresses or aliases
- any of various buffers involved in _hf_gethtbyname2 is out of space
>Fix:
diff --git a/lib/libc/net/sethostent.c b/lib/libc/net/sethostent.c
index b5f7ac8f2058..1029b3308c93 100644
--- a/lib/libc/net/sethostent.c
+++ b/lib/libc/net/sethostent.c
@@ -172,6 +172,7 @@ _hf_gethtbyname2(const char *name, int af, struct getnamaddr *info)

 	if ((ptr = buf = malloc(len = info->buflen)) == NULL) {
 		*info->he = NETDB_INTERNAL;
+		endhostent_r(&hf);
 		return NULL;
 	}

@@ -252,6 +253,7 @@ _hf_gethtbyname2(const char *name, int af, struct getnamaddr *info)
 	return hp;
 nospc:
 	*info->he = NETDB_INTERNAL;
+	endhostent_r(&hf);
 	free(buf);
 	errno = ENOSPC;
 	return NULL;

>Release-Note:

>Audit-Trail:
From: Taylor R Campbell <riastradh@NetBSD.org>
To: gnats-bugs@NetBSD.org
Cc: netbsd-bugs@NetBSD.org
Subject: Re: lib/57758: resource leak in /etc/hosts gethostbyname (libc/net/sethostent.c)
Date: Thu, 7 Dec 2023 23:28:02 +0000

 Correction: missing /etc/hosts is not a leak condition, but malloc
 failure is a leak condition.

From: Taylor R Campbell <riastradh@NetBSD.org>
To: gnats-bugs@NetBSD.org
Cc: netbsd-bugs@NetBSD.org
Subject: Re: lib/57758: resource leak in /etc/hosts gethostbyname (libc/net/sethostent.c)
Date: Thu, 7 Dec 2023 23:31:39 +0000

 kre@ has committed the fix:

 https://mail-index.netbsd.org/source-changes/2023/12/07/msg148768.html

 Needs pullups to 10, 9, and 8.  Would be nice to have an automatic
 test for this, but that might be more trouble than it's worth for now.

State-Changed-From-To: open->needs-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Thu, 07 Dec 2023 23:35:33 +0000
State-Changed-Why:


From: Robert Elz <kre@munnari.OZ.AU>
To: Taylor R Campbell <riastradh@NetBSD.org>
Cc: gnats-bugs@NetBSD.org, netbsd-bugs@NetBSD.org
Subject: Re: lib/57758: resource leak in /etc/hosts gethostbyname (libc/net/sethostent.c)
Date: Sun, 10 Dec 2023 10:24:11 +0700

 pullup-19 #488

From: Robert Elz <kre@munnari.OZ.AU>
To: Taylor R Campbell <riastradh@NetBSD.org>
Cc: gnats-bugs@NetBSD.org, netbsd-bugs@NetBSD.org
Subject: Re: lib/57758: resource leak in /etc/hosts gethostbyname (libc/net/sethostent.c)
Date: Sun, 10 Dec 2023 10:25:14 +0700

 I meant, pullup-10 #488 of course!

State-Changed-From-To: needs-pullups->pending-pullups
State-Changed-By: kre@NetBSD.org
State-Changed-When: Sun, 10 Dec 2023 05:39:25 +0000
State-Changed-Why:
Pullups to -10 -9 and -8 requested.


From: Robert Elz <kre@munnari.OZ.AU>
To: Taylor R Campbell <riastradh@NetBSD.org>
Cc: gnats-bugs@NetBSD.org, netbsd-bugs@NetBSD.org
Subject: Re: lib/57758: resource leak in /etc/hosts gethostbyname (libc/net/sethostent.c)
Date: Sun, 10 Dec 2023 12:37:31 +0700

 pullup-9 #1776
 pullup-8 #1925

State-Changed-From-To: pending-pullups->closed
State-Changed-By: kre@NetBSD.org
State-Changed-When: Sun, 10 Dec 2023 14:59:28 +0000
State-Changed-Why:
Pullups to 8, 8 & 10 completed.


>Unformatted:

Home	PR Database Search