From fd8991cc59305a071e9f1765b3e1e09de9339bc3 Mon Sep 17 00:00:00 2001 From: Gabor Juhos Date: Tue, 6 Apr 2010 09:55:19 +0200 Subject: Fix use-after-free bug in __dns_lookup If the type of the first answer does not match with the requested type, then the dotted name was freed. If there are no further answers in the DNS reply, this pointer was used later on in the same function. Additionally it is passed to the caller, and caused strange behaviour. Signed-off-by: Gabor Juhos Signed-off-by: Bernhard Reutner-Fischer --- libc/inet/resolv.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/libc/inet/resolv.c b/libc/inet/resolv.c index 056539f6e..9459199da 100644 --- a/libc/inet/resolv.c +++ b/libc/inet/resolv.c @@ -1517,10 +1517,8 @@ int attribute_hidden __dns_lookup(const char *name, memcpy(a, &ma, sizeof(ma)); if (a->atype != T_SIG && (NULL == a->buf || (type != T_A && type != T_AAAA))) break; - if (a->atype != type) { - free(a->dotted); + if (a->atype != type) continue; - } a->add_count = h.ancount - j - 1; if ((a->rdlength + sizeof(struct in_addr*)) * a->add_count > a->buflen) break; -- cgit v1.2.3