From mboxrd@z Thu Jan  1 00:00:00 1970
X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/6881
Path: news.gmane.org!not-for-mail
From: =?UTF-8?Q?Daniel_Cegie=C5=82ka?= <daniel.cegielka@gmail.com>
Newsgroups: gmane.linux.lib.musl.general
Subject: Re: gethostbyname buffer overflow (glibc)
Date: Tue, 27 Jan 2015 18:23:32 +0100
Message-ID: <CAPLrYET+_akiOs3+Cruf=5ri-Cf-Kot457x_XL34WtnQZdjjAA@mail.gmail.com>
References: <CAPLrYES9oEF5XB32Q8tDxYuDJ8wOZ6iiZEQz3vxbun2vtqrYuQ@mail.gmail.com>
 <20150127171045.GX4574@brightrain.aerifal.cx>
Reply-To: musl@lists.openwall.com
NNTP-Posting-Host: plane.gmane.org
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Trace: ger.gmane.org 1422379452 7366 80.91.229.3 (27 Jan 2015 17:24:12 GMT)
X-Complaints-To: usenet@ger.gmane.org
NNTP-Posting-Date: Tue, 27 Jan 2015 17:24:12 +0000 (UTC)
To: musl@lists.openwall.com
Original-X-From: musl-return-6894-gllmg-musl=m.gmane.org@lists.openwall.com Tue Jan 27 18:24:12 2015
Return-path: <musl-return-6894-gllmg-musl=m.gmane.org@lists.openwall.com>
Envelope-to: gllmg-musl@m.gmane.org
Original-Received: from mother.openwall.net ([195.42.179.200])
	by plane.gmane.org with smtp (Exim 4.69)
	(envelope-from <musl-return-6894-gllmg-musl=m.gmane.org@lists.openwall.com>)
	id 1YG9rz-0005I3-T9
	for gllmg-musl@m.gmane.org; Tue, 27 Jan 2015 18:24:07 +0100
Original-Received: (qmail 18298 invoked by uid 550); 27 Jan 2015 17:24:05 -0000
Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm
Precedence: bulk
List-Post: <mailto:musl@lists.openwall.com>
List-Help: <mailto:musl-help@lists.openwall.com>
List-Unsubscribe: <mailto:musl-unsubscribe@lists.openwall.com>
List-Subscribe: <mailto:musl-subscribe@lists.openwall.com>
Original-Received: (qmail 18281 invoked from network); 27 Jan 2015 17:24:04 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:in-reply-to:references:from:date:message-id:subject:to
         :content-type:content-transfer-encoding;
        bh=zZ5ew1z8Q0lkibE2sGMV8BpxCVemQzxHmKTcXrNHdfs=;
        b=m/RKOJ2NqO2hV/aET985FX6yB8zKuQKwbMX+jXF8GVVf+HOWGA6nOVNa5eXpAwSb1Y
         kaESTl3+hSZ7AFOoZrIf39Ub8Hw5xhNy0HHZ0ndZwQ9yJ8PYWRko8LNkMDAMDK3hwvqT
         3VS4qmlCknx4oquuSq7RguLiy/XacCiKhjBgM9XMP+/ircWKz0eevdLVVrlweNAHaH8M
         Enq7Ba+JwNAedM9TSwzB1WkK1iqA7pyPV9sdFspADXsGaLBwD/5R86Q5RVMwBoUOg9Z+
         J8YIHw8t/FbFdbdQ4fzE76qCNozwDxa2f8Zxsb0Lm7LojBoeY5i7Y0BjUOO8XC6rE6GI
         aKvA==
X-Received: by 10.182.28.100 with SMTP id a4mr1461890obh.69.1422379432997;
 Tue, 27 Jan 2015 09:23:52 -0800 (PST)
In-Reply-To: <20150127171045.GX4574@brightrain.aerifal.cx>
Xref: news.gmane.org gmane.linux.lib.musl.general:6881
Archived-At: <http://permalink.gmane.org/gmane.linux.lib.musl.general/6881>

2015-01-27 18:10 GMT+01:00 Rich Felker <dalias@libc.org>:
> On Tue, Jan 27, 2015 at 05:59:36PM +0100, Daniel Cegie=C5=82ka wrote:
>> eg from:
>>
>> http://www.openwall.com/lists/oss-security/2015/01/27/9
>>
>> # gcc ghost.c && ./a.out
>> should not happen
>>
>>
>>   retval =3D gethostbyname_r(name, &resbuf, temp.buffer,
>> sizeof(temp.buffer), &result, &herrno);
>>
>>   if (strcmp(temp.canary, CANARY) !=3D 0) {
>>     puts("vulnerable");
>>     exit(EXIT_SUCCESS);
>>   }
>>   if (retval =3D=3D ERANGE) {
>>     puts("not vulnerable");
>>     exit(EXIT_SUCCESS);
>>   }
>>   puts("should not happen");
>>   exit(EXIT_FAILURE);
>>
>> Double exit. Is something wrong with gethostbyname_r() in musl?
>
> I'm not sure what you mean by "double exit".

ghost.c return EXIT_FAILURE instead EXIT_SUCCESS, which is checked in
two cases (only)...

> As far as I can tell,
> musl just detects errors in a different order, and returns ENOENT (2)
> rather than ERANGE because the name is not valid.

... and yes, ghost.c should also check the other errors.

thx

> Rich