* Merged latest OpenBSD changes for inet_net_pton_ipv6() into c-ares.
* Always use our own IP conversion functions now, do not delegate to OS
so we can have consistency in testing and fuzzing.
* Removed bogus test cases that never should have passed.
* Add new test case for crash bug found.
Fix By: Brad House (@bradh352)
* segment random number generation into own file
* abstract random code to make it more modular so we can have multiple backends
* rand: add support for arc4random_buf() and also direct CARES_RANDOM_FILE reading
* autotools: fix detection of arc4random_buf
* rework initial rc4 seed for PRNG as last fallback
* rc4: more proper implementation, simplified for clarity
* clarifications
* CARES_RANDOM_FILE should always default to /dev/urandom
During cross-compilation, CARES_RANDOM_FILE may not be able to be appropriately
detected, therefore we should always set it to /dev/urandom and allow the
entity requesting compilation override the value. The code does appropriately
fall back if CARES_RANDOM_FILE cannot be opened.
* use set not option
As per #517 glibc allows a service/servname of "0" to be treated the
same as if NULL was provided. Also, add a sanity check to ensure
the port number is in range instead of a blind cast.
Fixes: #517
Fix By: Brad House (@bradh352)
When the condition channel->nservers < 1 holds, the function returns
prematurely, without deallocating query->tcpbuf. We rearrange the
check to be done prior to the allocations, avoiding the memory
leak. In this way, we also avoid unnecessary allocations if
channel->nservers < 1 holds.
Fix By: Nikolaos Chatzikonstantinou (@createyourpersonalaccount)
Following the README.md guidelines,
"Comments must be written in the old-style"
the comment is changed to the old style.
Fix By: Nikolaos Chatzikonstantinou (@createyourpersonalaccount)
strncasecmp on platforms that don't already have it is already #define'd to a private implementation. There is no need to have OS-specific logic. Also removes ares__strsplit.h as a header as ares_private.h already includes it.
Fix By: Nikolaos Chatzikonstantinou (@createyourpersonalaccount)
- Modify the Watcom Makefile for the source code reorganization (#352)
- Add *.map files into .gitignore
- Fix build errors with Watcom's builtin Windows SDK (which is rather
outdated). It's smart enough to understand Windows Vista, but doesn't
have PMIB_UNICASTIPADDRESS_TABLE or MIB_IPFORWARD_ROW2.
It may be possible to use a different Windows SDK with the Watcom
compiler, such as the most recent Windows 10 SDK. Alternatively the SDK
in OpenWatcom 2.0 (which is in development) should fix this.
I have no problems testing this Makefile prior to releases, just give me
a ping.
Tested with Windows Vista, Windows 7, and Windows 10 using 'adig',
'acountry', and 'ahost'. This also seems to work on Windows XP, though
this is likely due to the compiler in use.
Fix By: Douglas R. Reno (@renodr)
Fixes Bug: #352
In some conditions Windows might try to use a stack address that has gone out of scope when determining where to read the hosts data from for file lookups.
Fix By: @Chilledheart
RFC6761 6.3 states:
The domain "localhost." and any names falling within ".localhost."
We were only honoring "localhost".
Fixes: #477
Fix By: Brad House (@bradh352)
As per #487, documentation states the port should be in network byte
order, but we can see from the test cases using MockServers on
different ports that this is not the case, it is definitely in host
byte order.
Fix By: Brad House (@bradh352)
In ares_set_sortlist, it calls config_sortlist(..., sortstr) to parse
the input str and initialize a sortlist configuration.
However, ares_set_sortlist has not any checks about the validity of the input str.
It is very easy to create an arbitrary length stack overflow with the unchecked
`memcpy(ipbuf, str, q-str);` and `memcpy(ipbufpfx, str, q-str);`
statements in the config_sortlist call, which could potentially cause severe
security impact in practical programs.
This commit add necessary check for `ipbuf` and `ipbufpfx` which avoid the
potential stack overflows.
fixes#496
Fix By: @hopper-vul
Recent ASAN versions picked up that acountry was passing stack
variables to ares_gethostbyname() then leaving the stack context.
We will now allocate a buffer for this.
Fix By: Brad House (@bradh352)
To make them render "nicer" in both terminals and on the website.
- Removes the bold
- Removes .PP lines
- Indents them more like proper code style
Fix By: Daniel Stenberg (@bagder)
* add ares_strsplit unit test
The test reveals a bug in the implementation of ares_strsplit when the
make_set parameter is set to 1, as distinct domains are confused for
equal:
out = ares_strsplit("example.com, example.co", ", ", 1, &n);
evaluates to n = 1 with out = { "example.com" }.
* bugfix and cleanup of ares_strsplit
The purpose of ares_strsplit in c-ares is to split a comma-delimited
string of unique (up to letter case) domains. However, because the
terminating NUL byte was not checked in the substrings when comparing
for uniqueness, the function would sometimes drop domains it should
not. For example,
ares_strsplit("example.com, example.co", ",")
would only result in a single domain "example.com".
Aside from this bugfix, the following cleanup is performed:
1. The tokenization now happens with the help of strcspn instead of the
custom function is_delim.
2. The function list_contains has been inlined.
3. The interface of ares_strsplit has been simplified by removing the
parameter make_set since in practice it was always 1.
4. There are fewer passes over the input string.
5. We resize the table using realloc() down to its minimum size.
6. The docstring of ares_strsplit is updated and also a couple typos
are fixed.
There occurs a single use of ares_strsplit and since the make_set
parameter has been removed, the call in ares_init.c is modified
accordingly. The unit test for ares_strsplit is also updated.
Fix By: Nikolaos Chatzikonstantinou (@createyourpersonalaccount)
Options `-we ###` and `-wd ###` should not include a whitespace. They are also deprecated and `-diag-error` and `-diag-disable` are their replacements.
Intel compiler 2021.6 is not able to be used in configure without the proposed patch.
Fix By: Stephen Sachs (@stephenmsachs)
On Apple platforms, libresolv reports the total timeout in retrans, not the per-query time. This patch undoes that math to get the per-query time, which is what c-ares expects. This is not perfect because libresolv is inconsistent on whether the timeout is multiplied by retry or retry+1, but I don't see any way to distinguish these cases.
Fix By: Marc Aldorasi (@marc-groundctl)
Daniel Stenberg
bradh352
Gregor Jasny
lifenjoiner
Nikolaos Chatzikonstantinou
Yijie Ma
Douglas R. Reno
Jay Freeman (saurik)
Chilledheart
hopper-vul
Stephen Sachs
Jonathan Ringer
Thomas Dreibholz
bsergean
Brad Spencer
Frank
marc-groundctl