From patchwork Wed Jun 24 16:00:58 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marcus Poller X-Patchwork-Id: 137731 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 3F5AF4BA2E0A for ; Wed, 24 Jun 2026 16:05:36 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 3F5AF4BA2E0A Authentication-Results: sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=crystaldown.de header.i=@crystaldown.de header.a=rsa-sha256 header.s=202506r header.b=RRWsx0aS; dkim=pass header.d=crystaldown.de header.i=@crystaldown.de header.a=ed25519-sha256 header.s=202506e header.b=DJN+QIHZ X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from solomon.in-ulm.de (solomon.in-ulm.de [217.10.14.45]) by sourceware.org (Postfix) with ESMTPS id D6E424BA2E0B for ; Wed, 24 Jun 2026 16:04:47 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org D6E424BA2E0B Authentication-Results: sourceware.org; dmarc=pass (p=reject dis=none) header.from=crystaldown.de Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=crystaldown.de ARC-Filter: OpenARC Filter v1.0.0 sourceware.org D6E424BA2E0B Authentication-Results: sourceware.org; arc=none smtp.remote-ip=217.10.14.45 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1782317099; cv=none; b=UbC8YlPp61lYC+rBs1AXry0NcJXnTQ9CO3+yLmN/s3Df5scpIVI3SE8egG7hoGaNj763iceWzhJ7/BOKOC/M+jGmZ1V8wZ77m3cPqzd3DtZvQWVd+5ipdbwsgbC8ps6YhPy09qhuNu0btCyjYkefnVDu4xO2/8DnagBM2Zm2peQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1782317099; c=relaxed/simple; bh=t17LcKpfCxqYK987Zxfvj+HUnhQfjwec+GRQOxlBHU4=; h=DKIM-Signature:DKIM-Signature:From:To:Subject:Date:Message-ID: MIME-Version; b=nQDhNOreKR92fH3g7WITpAvQVbMnTPUHVoCxTTtjGrkVUQ+DH5ygAqrsqKMQJnnG5/IZJdb/1AudGy4S4yEVzfDNk23EmiGnuYFqpar6FD07piWx/NP0aqtPXWBmCglRz4BP+g5OhXPcIrUrQA3+mcS2YTt8DEKKBZMgj2QEzes= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=crystaldown.de header.i=@crystaldown.de header.a=rsa-sha256 header.s=202506r header.b=RRWsx0aS; dkim=pass header.d=crystaldown.de header.i=@crystaldown.de header.a=ed25519-sha256 header.s=202506e header.b=DJN+QIHZ DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org D6E424BA2E0B DKIM-Signature: v=1; a=rsa-sha256; s=202506r; d=crystaldown.de; c=relaxed/relaxed; h=Message-ID:Date:Subject:To:From; t=1782316961; bh=WfXoG6BTx+tt17LCyhoGByU Ik1eGAWhPP9hy3YVuJu4=; b=RRWsx0aSNMQ8rPI/gOkW0lVyFPTW6ip+/BY6Un8v8OE7Axywfs rBeqHVgnDe2yNxrWpfpyhRwMSt58y5ftBncqrmfeOUltKTJyysDTFUeE7seJ8/F1r+4HoDmqvWG C9PmQVs1DPyjocBFZdYm36a4gowFcD4fYaMC5stHqS0NtOIBcwrcp55uVIZjdGcPyO3M5nzeks1 bgiuCyuhdLbItTJDApSvxLW9HLioTZSgvBH7Zk4n7MEGRkJ4dZFMklgGZcpE3e2NcxqQm5OC6XQ 23Y8WFOzpkpZa6Ph6xv9jRgFX4ixUSPm8lBKaxqza7PyRD02dODsa6RtOEf4xiNjobA==; DKIM-Signature: v=1; a=ed25519-sha256; s=202506e; d=crystaldown.de; c=relaxed/relaxed; h=Message-ID:Date:Subject:To:From; t=1782316962; bh=WfXoG6BTx+tt17LCyhoGByU Ik1eGAWhPP9hy3YVuJu4=; b=DJN+QIHZTcku+YOS57Q2siXVz5Mk0paxrO/Jk5K1rNwUOxt8Xr Gqd+J0mRVL9J0r+MFOMAQh5ScZfS7t4PfBAA==; From: Marcus Poller To: libc-alpha@sourceware.org Cc: Marcus Poller Subject: [PATCH v3] nss: Use reallocarray to prevent integer overflow in getaddrinfo (bug 33977) Date: Wed, 24 Jun 2026 18:00:58 +0200 Message-ID: <20260624160228.2074235-2-h-glibcdev@crystaldown.de> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 X-Spam-Status: No, score=-14.1 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, SPF_HELO_NONE, SPF_PASS shortcircuit=no autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces~patchwork=sourceware.org@sourceware.org replacing realloc by reallocarray introduces a basic overflow check. (old + count) might still overflow, but since the NSS backend is trusted, we do not consider this to be a valid case. Reviewed-by: Arjun Shankar --- v1: https://inbox.sourceware.org/libc-alpha/77a01db3-5619-48b8-9682-85f11cc472bc@crystaldown.de/ v2: iterated on Arjuns and Andreas review comments v3: re-submission to support existing tooling --- nss/getaddrinfo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nss/getaddrinfo.c b/nss/getaddrinfo.c index 4f6ac3358a..b6ac0b2dcc 100644 --- a/nss/getaddrinfo.c +++ b/nss/getaddrinfo.c @@ -234,7 +234,7 @@ convert_hostent_to_gaih_addrtuple (const struct addrinfo *req, int family, array = array->next; } - array = realloc (res->at, (old + count) * sizeof (*array)); + array = reallocarray (res->at, old + count, sizeof (*array)); if (array == NULL) return false;