Bug 202142 - Uninitialized variable usage in error path in _dns_getaddrinfo()
Summary: Uninitialized variable usage in error path in _dns_getaddrinfo()
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Some People
Assignee: Hajimu UMEMOTO
URL:
Keywords: patch
Depends on:
Blocks:
 
Reported: 2015-08-06 19:36 UTC by Sean Boudreau
Modified: 2015-12-17 16:14 UTC (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sean Boudreau 2015-08-06 19:36:45 UTC 
The calls to RES_SET_H_ERRNO() macro on error paths wind up
dereferencing an uninitialized res:

Index: net/getaddrinfo.c
===================================================================
--- net/getaddrinfo.c	(revision 286381)
+++ net/getaddrinfo.c	(working copy)
@@ -2154,6 +2154,8 @@
 	memset(&sentinel, 0, sizeof(sentinel));
 	cur = &sentinel;
 
+	res = __res_state();
+
 	buf = malloc(sizeof(*buf));
 	if (!buf) {
 		RES_SET_H_ERRNO(res, NETDB_INTERNAL);
@@ -2200,7 +2202,6 @@
 		return NS_UNAVAIL;
 	}
 
-	res = __res_state();
 	if ((res->options & RES_INIT) == 0 && res_ninit(res) == -1) {
 		RES_SET_H_ERRNO(res, NETDB_INTERNAL);
 		free(buf);
Comment 1 commit-hook freebsd_committer freebsd_triage 2015-12-10 11:12:27 UTC 
A commit references this bug:

Author: ume
Date: Thu Dec 10 11:11:44 UTC 2015
New revision: 292059
URL: https://svnweb.freebsd.org/changeset/base/292059

Log:
  The calls to RES_SET_H_ERRNO() macro on error paths wind up
  dereferencing an uninitialized res.

  PR:		202142
  Submitted by:	Sean Boudreau
  MFC after:	1 week

Changes:
  head/lib/libc/net/getaddrinfo.c
Comment 2 Hajimu UMEMOTO freebsd_committer freebsd_triage 2015-12-10 11:19:22 UTC 
Thank you for your report.  I've committed it into 11-CURRENT.  I'll do MFC it after 1 week.
Comment 3 commit-hook freebsd_committer freebsd_triage 2015-12-17 16:08:57 UTC 
A commit references this bug:

Author: ume
Date: Thu Dec 17 16:08:28 UTC 2015
New revision: 292403
URL: https://svnweb.freebsd.org/changeset/base/292403

Log:
  MFC r292059:
    The calls to RES_SET_H_ERRNO() macro on error paths wind up
    dereferencing an uninitialized res.

  PR:		202142
  Submitted by:	Sean Boudreau

Changes:
_U  stable/10/
  stable/10/lib/libc/net/getaddrinfo.c
Comment 4 commit-hook freebsd_committer freebsd_triage 2015-12-17 16:09:59 UTC 
A commit references this bug:

Author: ume
Date: Thu Dec 17 16:09:15 UTC 2015
New revision: 292404
URL: https://svnweb.freebsd.org/changeset/base/292404

Log:
  MFC r292059:
    The calls to RES_SET_H_ERRNO() macro on error paths wind up
    dereferencing an uninitialized res.

  PR:		202142
  Submitted by:	Sean Boudreau

Changes:
_U  stable/9/lib/libc/
  stable/9/lib/libc/net/getaddrinfo.c