From mboxrd@z Thu Jan  1 00:00:00 1970
X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/6880
Path: news.gmane.org!not-for-mail
From: Rich Felker <dalias@libc.org>
Newsgroups: gmane.linux.lib.musl.general
Subject: Re: gethostbyname buffer overflow (glibc)
Date: Tue, 27 Jan 2015 12:10:46 -0500
Message-ID: <20150127171045.GX4574@brightrain.aerifal.cx>
References: <CAPLrYES9oEF5XB32Q8tDxYuDJ8wOZ6iiZEQz3vxbun2vtqrYuQ@mail.gmail.com>
Reply-To: musl@lists.openwall.com
NNTP-Posting-Host: plane.gmane.org
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
X-Trace: ger.gmane.org 1422378663 22638 80.91.229.3 (27 Jan 2015 17:11:03 GMT)
X-Complaints-To: usenet@ger.gmane.org
NNTP-Posting-Date: Tue, 27 Jan 2015 17:11:03 +0000 (UTC)
To: musl@lists.openwall.com
Original-X-From: musl-return-6893-gllmg-musl=m.gmane.org@lists.openwall.com Tue Jan 27 18:11:03 2015
Return-path: <musl-return-6893-gllmg-musl=m.gmane.org@lists.openwall.com>
Envelope-to: gllmg-musl@m.gmane.org
Original-Received: from mother.openwall.net ([195.42.179.200])
	by plane.gmane.org with smtp (Exim 4.69)
	(envelope-from <musl-return-6893-gllmg-musl=m.gmane.org@lists.openwall.com>)
	id 1YG9fK-0008SU-Em
	for gllmg-musl@m.gmane.org; Tue, 27 Jan 2015 18:11:02 +0100
Original-Received: (qmail 16170 invoked by uid 550); 27 Jan 2015 17:11:00 -0000
Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm
Precedence: bulk
List-Post: <mailto:musl@lists.openwall.com>
List-Help: <mailto:musl-help@lists.openwall.com>
List-Unsubscribe: <mailto:musl-unsubscribe@lists.openwall.com>
List-Subscribe: <mailto:musl-subscribe@lists.openwall.com>
Original-Received: (qmail 16147 invoked from network); 27 Jan 2015 17:10:59 -0000
Content-Disposition: inline
In-Reply-To: <CAPLrYES9oEF5XB32Q8tDxYuDJ8wOZ6iiZEQz3vxbun2vtqrYuQ@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Original-Sender: Rich Felker <dalias@aerifal.cx>
Xref: news.gmane.org gmane.linux.lib.musl.general:6880
Archived-At: <http://permalink.gmane.org/gmane.linux.lib.musl.general/6880>

On Tue, Jan 27, 2015 at 05:59:36PM +0100, Daniel Cegiełka wrote:
> eg from:
> 
> http://www.openwall.com/lists/oss-security/2015/01/27/9
> 
> # gcc ghost.c && ./a.out
> should not happen
> 
> 
>   retval = gethostbyname_r(name, &resbuf, temp.buffer,
> sizeof(temp.buffer), &result, &herrno);
> 
>   if (strcmp(temp.canary, CANARY) != 0) {
>     puts("vulnerable");
>     exit(EXIT_SUCCESS);
>   }
>   if (retval == ERANGE) {
>     puts("not vulnerable");
>     exit(EXIT_SUCCESS);
>   }
>   puts("should not happen");
>   exit(EXIT_FAILURE);
> 
> Double exit. Is something wrong with gethostbyname_r() in musl?

I'm not sure what you mean by "double exit". As far as I can tell,
musl just detects errors in a different order, and returns ENOENT (2)
rather than ERANGE because the name is not valid.

Rich