mirror of https://github.com/c-ares/c-ares.git
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
83 lines
3.3 KiB
83 lines
3.3 KiB
c-ares version 1.17.2 |
|
|
|
This is a security and bugfix release. It addresses a few security related |
|
issues along with various bugfixes mostly related to portability. |
|
|
|
Security: |
|
o NodeJS passes NULL for addr and 0 for addrlen to ares_parse_ptr_reply() on |
|
systems where malloc(0) returns NULL. This would cause a crash. [8] |
|
o When building c-ares with CMake, the RANDOM_FILE would not be set and |
|
therefore downgrade to the less secure random number generator [12] |
|
o If ares_getaddrinfo() was terminated by an ares_destroy(), it would cause |
|
a crash [13] |
|
o Crash in sortaddrinfo() if the list size equals 0 due to an unexpected |
|
DNS response [14] |
|
o Expand number of escaped characters in DNS replies as per RFC1035 5.1 to |
|
prevent spoofing [16], [17] |
|
o Perform validation on hostnames to prevent possible XSS due to applications |
|
not performing valiation themselves [18] |
|
|
|
Changes: |
|
o Use non-blocking /dev/urandom for random data to prevent early startup |
|
performance issues [5] |
|
o z/OS port [6] |
|
o ares_malloc(0) is now defined behavior (returns NULL) rather than |
|
system-specific to catch edge cases [7] |
|
|
|
Bug fixes: |
|
o Fuzz testing files were not distributed with official archives [1] |
|
o Building tests should not force building of static libraries except on |
|
Windows [2] |
|
o Windows builds of the tools would fail if built as static due to a missing |
|
CARES_STATICLIB definition [3] |
|
o Relative headers must use double quotes to prevent pulling in a system |
|
library [4] |
|
o Fix OpenBSD building by implementing portability updates for including |
|
arpa/nameser.h [9] |
|
o Fix building out-of-tree for autotools [10] |
|
o Make install on MacOS/iOS with CMake was missing the bundle destination so |
|
libraries weren't actually installed [11] |
|
o Fix retrieving DNS server configuration on MacOS and iOS if the configuration |
|
did not include search domains [15] |
|
o ares_parse_a_reply and ares_parse_aaa_reply were erroneously using strdup() |
|
instead of ares_strdup() [19] |
|
|
|
|
|
Thanks go to these friendly people for their efforts and contributions: |
|
Anton Danielsson (@anton-danielsson) |
|
Brad House (@bradh352) |
|
Daniel Stenberg (@bagder) |
|
Dhrumil Rana (@dhrumilrana) |
|
František Dvořák (@valtri) |
|
@halx99 |
|
Jay Freeman (@saurik) |
|
Jean-pierre Cartal (@jeanpierrecartal) |
|
Michael Kourlas |
|
Philipp Jeitner |
|
@vburdo |
|
(11 contributors) |
|
|
|
References to bug reports and discussions on issues: |
|
[1] = https://github.com/c-ares/c-ares/issues/379 |
|
[2] = https://github.com/c-ares/c-ares/issues/380 |
|
[3] = https://github.com/c-ares/c-ares/issues/384 |
|
[4] = https://github.com/c-ares/c-ares/pull/386 |
|
[5] = https://github.com/c-ares/c-ares/pull/391 |
|
[6] = https://github.com/c-ares/c-ares/pull/390 |
|
[7] = https://github.com/c-ares/c-ares/commit/485fb66 |
|
[8] = https://github.com/c-ares/c-ares/issues/392 |
|
[9] = https://github.com/c-ares/c-ares/issues/388 |
|
[10] = https://github.com/c-ares/c-ares/pull/394 |
|
[11] = https://github.com/c-ares/c-ares/pull/395 |
|
[12] = https://github.com/c-ares/c-ares/pull/397 |
|
[13] = https://github.com/c-ares/c-ares/commit/df94703 |
|
[14] = https://github.com/c-ares/c-ares/pull/400 |
|
[15] = https://github.com/c-ares/c-ares/pull/401 |
|
[16] = https://github.com/c-ares/c-ares/commit/362f91d |
|
[17] = https://github.com/c-ares/c-ares/commit/44c009b |
|
[18] = https://github.com/c-ares/c-ares/commit/c9b6c60 |
|
[19] = https://github.com/c-ares/c-ares/pull/408 |
|
|
|
|
|
|
|
|
|
|