musl - an implementation of the standard library for Linux-based systems
Go to file
Rich Felker 41603c7706 dns response handling: ignore presence of wrong-type RRs
reportedly there is nameserver software with question-rewriting
"functionality" which gives A answers when AAAA is queried. since we
made no effort to validate that the answer RR type actually
corresponds to the question asked, it was possible (depending on
flags, etc.) for these answers to leak through, which the caller might
not be prepared for. indeed, our implementation of gethostbyname2_r
makes an assumption that the resulting addresses are in the family
requested, and will misinterpret the results if they don't.

commit 45ca5d3fcb already noted in
fixing CVE-2017-15650 that this could happen, but did nothing to
validate that the RR type of the answer matches the question; it just
enforced the limit on number of results to preclude overflow.

presently, name_from_dns ignores the return value of __dns_parse, so
it doesn't really matter whether we return 0 (ignoring the RR) or -1
(parse-ending error) upon encountering the mismatched RR. if that ever
changes, though, ignoring irrelevant answer RRs sounds like the
semantically correct thing to do, so for now let's return 0 from the
callback when this happens.
2022-10-19 14:01:32 -04:00
arch re-enable vdso clock_gettime on arm (32-bit) with workaround 2022-09-19 13:21:54 -04:00
compat/time32 remove LFS64 symbol aliases; replace with dynamic linker remapping 2022-10-19 14:01:31 -04:00
crt remove unnecessary and problematic _Noreturn from crt/ldso startup 2019-06-25 19:05:40 -04:00
dist add another example option to dist/config.mak 2012-04-24 16:49:11 -04:00
include remove LFS64 programming interfaces (macro-only) from _GNU_SOURCE 2022-10-19 14:01:31 -04:00
ldso remove LFS64 symbol aliases; replace with dynamic linker remapping 2022-10-19 14:01:31 -04:00
src dns response handling: ignore presence of wrong-type RRs 2022-10-19 14:01:32 -04:00
tools fix incorrect escaping in add-cfi.*.awk scripts 2020-01-20 15:57:29 -05:00
.gitignore remove obsolete gitignore rules 2016-07-06 00:21:25 -04:00
.mailmap update contributor name 2019-12-07 12:21:35 -05:00
configure configure: disable TBAA optimization because most compilers are buggy 2022-10-19 14:01:31 -04:00
COPYRIGHT add optimized aarch64 memcpy and memset 2020-06-26 17:49:51 -04:00
dynamic.list fix regression in access to optopt object 2018-11-19 13:20:41 -05:00
INSTALL fix typo in INSTALL 2020-11-29 00:46:38 -05:00
Makefile make mallocng the default malloc implementation 2020-06-30 15:38:27 -04:00
README update version reference in the README file 2014-06-25 14:16:53 -04:00
VERSION release 1.2.3 2022-04-07 13:12:40 -04:00
WHATSNEW release 1.2.3 2022-04-07 13:12:40 -04:00

    musl libc

musl, pronounced like the word "mussel", is an MIT-licensed
implementation of the standard C library targetting the Linux syscall
API, suitable for use in a wide range of deployment environments. musl
offers efficient static and dynamic linking support, lightweight code
and low runtime overhead, strong fail-safe guarantees under correct
usage, and correctness in the sense of standards conformance and
safety. musl is built on the principle that these goals are best
achieved through simple code that is easy to understand and maintain.

The 1.1 release series for musl features coverage for all interfaces
defined in ISO C99 and POSIX 2008 base, along with a number of
non-standardized interfaces for compatibility with Linux, BSD, and
glibc functionality.

For basic installation instructions, see the included INSTALL file.
Information on full musl-targeted compiler toolchains, system
bootstrapping, and Linux distributions built on musl can be found on
the project website:

    http://www.musl-libc.org/