Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

careless use of gethostbyname() in Socket.xs #8887

p5pRT opened this issue May 1, 2007 · 4 comments

careless use of gethostbyname() in Socket.xs #8887

p5pRT opened this issue May 1, 2007 · 4 comments


Copy link

@p5pRT p5pRT commented May 1, 2007

Migrated from (status was 'resolved')

Searchable as RT42844$

Copy link

@p5pRT p5pRT commented May 1, 2007


Created by

Socket​::inet_aton is implemented as follows (in ext/Socket/Socket.xs)​:

  char * host
  struct in_addr ip_address;
  struct hostent * phe;
  int ok =
  (host != NULL) &&
  (*host != '\0') &&
  inet_aton(host, &ip_address);

  if (!ok && (phe = gethostbyname(host))) {
  Copy( phe->h_addr, &ip_address, phe->h_length, char );
  ok = 1;

  ST(0) = sv_newmortal();
  if (ok)
  sv_setpvn( ST(0), (char *)&ip_address, sizeof ip_address );

This code fails when phe->h_length != sizeof ip_address. This can happen
when gethostbyname() returns an address of unexpected type (e.g. AF_INET6)
or when the local DNS resolver is naive enough to accept A records of
unusual size (see <http​://>).

It is recommended to check the result gethostbyname() before using it
(see <http​://> or

I think the code calling gethostbyname() should be changed to read
  if (!ok && (phe = gethostbyname(host)) &&
  phe->h_addrtype == AF_INET && phe->h_length == 4) {
  Copy( phe->h_addr, &ip_address, phe->h_length, char );
  ok = 1;

(This can leak unitialized stack bytes to "perl-land" when
sizeof(ip_address) > 4.)

Perl Info


This perlbug was built using Perl v5.8.8 in the Red Hat build system.
It is being executed now by Perl v5.8.8 - Sat Feb 17 05:53:14 CST 2007.

Site configuration information for perl v5.8.8:

Configured by Red Hat, Inc. at Sat Feb 17 05:53:14 CST 2007.

Summary of my perl5 (revision 5 version 8 subversion 8) configuration:
    osname=linux, osvers=2.6.9-42.0.3.elsmp, archname=i386-linux-thread-multi
    uname='linux build-i386 2.6.9-42.0.3.elsmp #1 smp fri oct 6 06:21:39 cdt 2006 i686 i686 i386 gnulinux '
    config_args='-des -Doptimize=-O2 -g -pipe -m32 -march=i386 -mtune=pentium4 -Dversion=5.8.8 -Dmyhostname=localhost -Dperladmin=root@localhost -Dcc=gcc -Dcf_by=Red Hat, Inc. -Dinstallprefix=/usr -Dprefix=/usr -Darchname=i386-linux -Dvendorprefix=/usr -Dsiteprefix=/usr -Duseshrplib -Dusethreads -Duseithreads -Duselargefiles -Dd_dosuid -Dd_semctl_semun -Di_db -Ui_ndbm -Di_gdbm -Di_shadow -Di_syslog -Dman3ext=3pm -Duseperlio -Dinstallusrbinperl=n -Ubincompat5005 -Uversiononly -Dpager=/usr/bin/less -isr -Dd_gethostent_r_proto -Ud_endhostent_r_proto -Ud_sethostent_r_proto -Ud_endprotoent_r_proto -Ud_setprotoent_r_proto -Ud_endservent_r_proto -Ud_setservent_r_proto -Dinc_version_list=5.8.7 5.8.6 5.8.5 5.8.4 5.8.3 -Dscriptdir=/usr/bin'
    hint=recommended, useposix=true, d_sigaction=define
    usethreads=define use5005threads=undef useithreads=define usemultiplicity=define
    useperlio=define d_sfio=undef uselargefiles=define usesocks=undef
    use64bitint=undef use64bitall=undef uselongdouble=undef
    usemymalloc=n, bincompat5005=undef
    cc='gcc', ccflags ='-D_REENTRANT -D_GNU_SOURCE -fno-strict-aliasing -pipe -Wdeclaration-after-statement -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm',
    optimize='-O2 -g -pipe -m32 -march=i386 -mtune=pentium4',
    cppflags='-D_REENTRANT -D_GNU_SOURCE -fno-strict-aliasing -pipe -Wdeclaration-after-statement -I/usr/local/include -I/usr/include/gdbm'
    ccversion='', gccversion='3.4.6 20060404 (Red Hat 3.4.6-3)', gccosandvers=''
    intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=1234
    d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12
    ivtype='long', ivsize=4, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8
    alignbytes=4, prototype=define
  Linker and Libraries:
    ld='gcc', ldflags =' -L/usr/local/lib'
    libpth=/usr/local/lib /lib /usr/lib
    libs=-lresolv -lnsl -lgdbm -ldb -ldl -lm -lcrypt -lutil -lpthread -lc
    perllibs=-lresolv -lnsl -ldl -lm -lcrypt -lutil -lpthread -lc
    libc=/lib/, so=so, useshrplib=true,
  Dynamic Linking:
    dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-Wl,-E -Wl,-rpath,/usr/lib/perl5/5.8.8/i386-linux-thread-multi/CORE'
    cccdlflags='-fPIC', lddlflags='-shared -L/usr/local/lib'

Locally applied patches:

@INC for perl v5.8.8:

Environment for perl v5.8.8:
    LANGUAGE (unset)
    LD_LIBRARY_PATH (unset)
    LOGDIR (unset)
    PERL_BADLANG (unset)

Copy link

@p5pRT p5pRT commented May 4, 2007

From @rgs

Thanks, I've implemented the suggested modification as change 31138.

Copy link

@p5pRT p5pRT commented May 4, 2007

The RT System itself - Status changed from 'new' to 'open'

Copy link

@p5pRT p5pRT commented May 4, 2007

@rgs - Status changed from 'open' to 'resolved'

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet

No branches or pull requests

1 participant