zyppe/anolis-glibc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

update to glibc-2.17-326.el7_9

Browse source 
Signed-off-by: layne yang <yangxiaoxuan@uniontech.com>
This commit is contained in:
layne yang 2022-05-20 20:59:04 +08:00
parent 3dbd3d12b6
commit 3cf6fb7970
6 changed files with 154 additions and 77 deletions
Download patch file Download diff file Expand all files Collapse all files

62
glibc-rh2065058-1.patch Normal file
View file

@ -0,0 +1,62 @@
Partial backport of:
commit 333221862ecbebde60dd16e7ca17d26444e62f50
Author: Florian Weimer <fweimer@redhat.com>
Date: Mon Apr 8 11:19:38 2019 +0200
resolv: Remove RES_INSECURE1, RES_INSECURE2
Always perform the associated security checks.
The constants and their debug output handling are preserved in this
backport.
diff --git a/resolv/res_send.c b/resolv/res_send.c
index 705ecb7189d215c2..c9b02cca130bc20d 100644
--- a/resolv/res_send.c
+++ b/resolv/res_send.c
@@ -1324,31 +1324,25 @@ send_dg(res_state statp,
*/
goto wait;
}
- if (!(statp->options & RES_INSECURE1) &&
- !res_ourserver_p(statp, &from)) {
- /*
- * response from wrong server? ignore it.
- * XXX - potential security hazard could
- * be detected here.
- */
- goto wait;
- }
- if (!(statp->options & RES_INSECURE2)
- && (recvresp1 || !res_queriesmatch(buf, buf + buflen,
+
+ /* Paranoia check. Due to the connected UDP socket,
+ the kernel has already filtered invalid addresses
+ for us. */
+ if (!res_ourserver_p(statp, &from))
+ goto wait;
+
+ /* Check for the correct header layout and a matching
+ question. */
+ if ((recvresp1 || !res_queriesmatch(buf, buf + buflen,
*thisansp,
*thisansp
+ *thisanssizp))
&& (recvresp2 || !res_queriesmatch(buf2, buf2 + buflen2,
*thisansp,
*thisansp
- + *thisanssizp))) {
- /*
- * response contains wrong query? ignore it.
- * XXX - potential security hazard could
- * be detected here.
- */
- goto wait;
- }
+ + *thisanssizp)))
+ goto wait;
+
if (anhp->rcode == SERVFAIL ||
anhp->rcode == NOTIMP ||
anhp->rcode == REFUSED) {