b3a96fb
Upstream commits:
b3a96fb
b3a96fb
commit 2959eda9272a033863c271aff62095abd01bd4e3
b3a96fb
Author: Arjun Shankar <arjun.is@lostca.se>
b3a96fb
Date:   Tue Apr 21 14:06:31 2015 +0200
b3a96fb
b3a96fb
    CVE-2015-1781: resolv/nss_dns/dns-host.c buffer overflow [BZ#18287]
b3a96fb
b3a96fb
Index: glibc-2.21/resolv/nss_dns/dns-host.c
b3a96fb
===================================================================
b3a96fb
--- glibc-2.21.orig/resolv/nss_dns/dns-host.c
b3a96fb
+++ glibc-2.21/resolv/nss_dns/dns-host.c
b3a96fb
@@ -615,7 +615,8 @@ getanswer_r (const querybuf *answer, int
b3a96fb
   int have_to_map = 0;
b3a96fb
   uintptr_t pad = -(uintptr_t) buffer % __alignof__ (struct host_data);
b3a96fb
   buffer += pad;
b3a96fb
-  if (__glibc_unlikely (buflen < sizeof (struct host_data) + pad))
b3a96fb
+  buflen = buflen > pad ? buflen - pad : 0;
b3a96fb
+  if (__glibc_unlikely (buflen < sizeof (struct host_data)))
b3a96fb
     {
b3a96fb
       /* The buffer is too small.  */
b3a96fb
     too_small: