asr: reject zero-length aliases / canon name in gethostbyname(3) / getaddrinfo(3).

Florian Obser <[email protected]>
Newsgroups gmane.os.openbsd.tech
Message-ID <[email protected]>
An empty string is arguably not a correct hostname (even though
res_hnok accepts it). More worrisome though is software not expecting
this and making mistakes. In practice this cannot happen unless the
resolver lies to us.

OK?

diff --git lib/libc/asr/getaddrinfo_async.c lib/libc/asr/getaddrinfo_async.c
index b24c1e39fef..a4740b70a52 100644
--- lib/libc/asr/getaddrinfo_async.c
+++ lib/libc/asr/getaddrinfo_async.c
@@ -678,7 +678,10 @@ addrinfo_from_pkt(struct asr_query *as, char *pkt, size_t pktlen)
 		if (as->as.ai.hints.ai_flags & AI_CANONNAME) {
 			_asr_strdname(rr.rr_dname, buf, sizeof buf);
 			buf[strlen(buf) - 1] = '\0';
-			c = res_hnok(buf) ? buf : as->as.ai.hostname;
+			if (buf[0] != '\0' && res_hnok(buf))
+				c = buf;
+			else
+				c = as->as.ai.hostname;
 		} else if (as->as.ai.hints.ai_flags & AI_FQDN)
 			c = as->as.ai.fqdn;
 		else
diff --git lib/libc/asr/gethostnamadr_async.c lib/libc/asr/gethostnamadr_async.c
index 0b9a6ab0641..b00497f3ae7 100644
--- lib/libc/asr/gethostnamadr_async.c
+++ lib/libc/asr/gethostnamadr_async.c
@@ -595,7 +595,7 @@ hostent_set_cname(struct hostent_ext *h, const char *name, int isdname)
 	if (isdname) {
 		_asr_strdname(name, buf, sizeof buf);
 		buf[strlen(buf) - 1] = '\0';
-		if (!res_hnok(buf))
+		if (buf[0] == '\0' || !res_hnok(buf))
 			return (-1);
 		name = buf;
 	}
@@ -625,7 +625,7 @@ hostent_add_alias(struct hostent_ext *h, const char *name, int isdname)
 	if (isdname) {
 		_asr_strdname(name, buf, sizeof buf);
 		buf[strlen(buf)-1] = '\0';
-		if (!res_hnok(buf))
+		if (buf[0] == '\0' || !res_hnok(buf))
 			return;
 		name = buf;
 	}


-- 
In my defence, I have been left unsupervised.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.