[Bug 1470965] [NEW] Backport fix for Glibc bug #16743: "getaddrinfo uses uninitialized data when processing nscd answer"

[Daniel Mewes]

Public bug reported:

The version of eglibc that comes with Ubuntu 14.04 appears to be
affected by Glibc bug #16743:
https://sourceware.org/bugzilla/show_bug.cgi?id=16743

I'm not aware of a corresponding bug filed against eglibc, but we
confirmed that eglibc in the Ubuntu 14.04 version has the same unpatched
code and exhibits the faulty behavior.

We had one of our users run into this when running RethinkDB https://github.com/rethinkdb/rethinkdb/issues/4470 on Ubuntu 14.04 with the latest updates installed. The user had two entries in /etc/hosts for a certain hostname, one with an IPv4 and one with an IPv6 address. Calling `getaddrinfo` on that hostname with nscd running exhibited the problem (also see https://github.com/rethinkdb/rethinkdb/issues/4470#issuecomment-117868264 for additional testing code, though the Glibc bug report seems to have a simpler test case using `getent`).
Shutting down nscd provides a work-around, since the affected code path in eglibc isn't used in that case.

Is there a chance to backport the glibc fix to Ubuntu 14.04's eglibc?

We're happy to prepare and submit a patch if that helps.

** Affects: glibc (Ubuntu)
     Importance: Undecided
         Status: New


** Tags: eglibc getaddrinfo nscd uninitialized

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to glibc in Ubuntu.
https://bugs.launchpad.net/bugs/1470965

Title:
  Backport fix for Glibc bug #16743: "getaddrinfo uses uninitialized
  data when processing nscd answer"

Status in glibc package in Ubuntu:
  New

Bug description:
  The version of eglibc that comes with Ubuntu 14.04 appears to be
  affected by Glibc bug #16743:
  https://sourceware.org/bugzilla/show_bug.cgi?id=16743

  I'm not aware of a corresponding bug filed against eglibc, but we
  confirmed that eglibc in the Ubuntu 14.04 version has the same
  unpatched code and exhibits the faulty behavior.

  We had one of our users run into this when running RethinkDB https://github.com/rethinkdb/rethinkdb/issues/4470 on Ubuntu 14.04 with the latest updates installed. The user had two entries in /etc/hosts for a certain hostname, one with an IPv4 and one with an IPv6 address. Calling `getaddrinfo` on that hostname with nscd running exhibited the problem (also see https://github.com/rethinkdb/rethinkdb/issues/4470#issuecomment-117868264 for additional testing code, though the Glibc bug report seems to have a simpler test case using `getent`).
  Shutting down nscd provides a work-around, since the affected code path in eglibc isn't used in that case.

  Is there a chance to backport the glibc fix to Ubuntu 14.04's eglibc?

  We're happy to prepare and submit a patch if that helps.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/glibc/+bug/1470965/+subscriptions