Skip to content

Bugfix/crash in ares sortaddrinfo#400

Merged
bradh352 merged 2 commits into
c-ares:masterfrom
catalinh-bd:bugfix/crash_in_ares__sortaddrinfo
Mar 5, 2021
Merged

Bugfix/crash in ares sortaddrinfo#400
bradh352 merged 2 commits into
c-ares:masterfrom
catalinh-bd:bugfix/crash_in_ares__sortaddrinfo

Conversation

@catalinh-bd
Copy link
Copy Markdown
Contributor

The patch set contains the following:

  • fix crash in ares__sortaddrinfo when sending an empty list
  • prevent sorting the hosts list if it's empty

The bug was generated because there was not check for the number
of items in the list and invalid memory was accesed when the list
was empty. There is a check for null after calling malloc but on
some systems it always returns a valid address for size equals 0.

For e.g., on macOS and Windows systems malloc returns a valid address:

https://man.openbsd.org/malloc.3
https://docs.microsoft.com/en-us/cpp/c-runtime-library/reference/malloc

However, on Linux malloc returns NULL if size equals 0:

https://man7.org/linux/man-pages/man3/malloc.3.html

Also, the openBSD manual says it more clearly:

If nmemb or size is equal to 0, a unique pointer to an access protected,
zero sized object is returned. Access via this pointer will generate a
SIGSEGV exception.

Relates To: c-ares#392, 0903dce
@bradh352 bradh352 merged commit fd890e9 into c-ares:master Mar 5, 2021
sergepetrenko pushed a commit to tarantool/c-ares that referenced this pull request Jul 29, 2022
The bug was generated because there was no check for the number
of items in the list and invalid memory was accesed when the list
was empty. There is a check for null after calling malloc but on
some systems it always returns a valid address for size equals 0.
Relates To: c-ares#392, 0903dce

Fix By: @catalinh-bd
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants