Blame SOURCES/0002-CVE-2023-32067.patch

0b2dfd
From 7af6c0ef6354288f8a8240e5ca44a55ab4c6cf91 Mon Sep 17 00:00:00 2001
0b2dfd
From: Alexey Tikhonov <atikhono@redhat.com>
0b2dfd
Date: Thu, 15 Jun 2023 18:04:50 +0200
0b2dfd
Subject: [PATCH] 
0b2dfd
 https://github.com/c-ares/c-ares/commit/b9b8413cfdb70a3f99e1573333b23052d57ec1ae
0b2dfd
0b2dfd
---
0b2dfd
 ares_process.c | 41 ++++++++++++++++++++++++-----------------
0b2dfd
 1 file changed, 24 insertions(+), 17 deletions(-)
0b2dfd
0b2dfd
diff --git a/ares_process.c b/ares_process.c
0b2dfd
index bbeca5e..ad7e862 100644
0b2dfd
--- a/ares_process.c
0b2dfd
+++ b/ares_process.c
0b2dfd
@@ -416,7 +416,7 @@ static void read_udp_packets(ares_channel channel, fd_set *read_fds,
0b2dfd
 {
0b2dfd
   struct server_state *server;
0b2dfd
   int i;
0b2dfd
-  ssize_t count;
0b2dfd
+  ssize_t read_len;
0b2dfd
   unsigned char buf[MAXENDSSZ + 1];
0b2dfd
 #ifdef HAVE_RECVFROM
0b2dfd
   ares_socklen_t fromlen;
0b2dfd
@@ -459,36 +459,43 @@ static void read_udp_packets(ares_channel channel, fd_set *read_fds,
0b2dfd
       /* To reduce event loop overhead, read and process as many
0b2dfd
        * packets as we can. */
0b2dfd
       do {
0b2dfd
-        if (server->udp_socket == ARES_SOCKET_BAD)
0b2dfd
-          count = 0;
0b2dfd
-
0b2dfd
-        else {
0b2dfd
+        if (server->udp_socket == ARES_SOCKET_BAD) {
0b2dfd
+          read_len = -1;
0b2dfd
+        } else {
0b2dfd
 #ifdef HAVE_RECVFROM
0b2dfd
-          if (server->addr.family == AF_INET)
0b2dfd
+          if (server->addr.family == AF_INET) {
0b2dfd
             fromlen = sizeof(from.sa4);
0b2dfd
-          else
0b2dfd
+          } else {
0b2dfd
             fromlen = sizeof(from.sa6);
0b2dfd
-          count = (ssize_t)recvfrom(server->udp_socket, (void *)buf,
0b2dfd
-                                    sizeof(buf), 0, &from.sa, &fromlen);
0b2dfd
+          }
0b2dfd
+          read_len = (ssize_t)recvfrom(server->udp_socket, (void *)buf,
0b2dfd
+                                       sizeof(buf), 0, &from.sa, &fromlen);
0b2dfd
 #else
0b2dfd
-          count = sread(server->udp_socket, buf, sizeof(buf));
0b2dfd
+          read_len = sread(server->udp_socket, buf, sizeof(buf));
0b2dfd
 #endif
0b2dfd
         }
0b2dfd
 
0b2dfd
-        if (count == -1 && try_again(SOCKERRNO))
0b2dfd
+        if (read_len == 0) {
0b2dfd
+          /* UDP is connectionless, so result code of 0 is a 0-length UDP
0b2dfd
+           * packet, and not an indication the connection is closed like on
0b2dfd
+           * tcp */
0b2dfd
           continue;
0b2dfd
-        else if (count <= 0)
0b2dfd
+        } else if (read_len < 0) {
0b2dfd
+          if (try_again(SOCKERRNO))
0b2dfd
+            continue;
0b2dfd
+
0b2dfd
           handle_error(channel, i, now);
0b2dfd
 #ifdef HAVE_RECVFROM
0b2dfd
-        else if (!same_address(&from.sa, &server->addr))
0b2dfd
+        } else if (!same_address(&from.sa, &server->addr)) {
0b2dfd
           /* The address the response comes from does not match the address we
0b2dfd
            * sent the request to. Someone may be attempting to perform a cache
0b2dfd
            * poisoning attack. */
0b2dfd
-          break;
0b2dfd
+          continue;
0b2dfd
 #endif
0b2dfd
-        else
0b2dfd
-          process_answer(channel, buf, (int)count, i, 0, now);
0b2dfd
-       } while (count > 0);
0b2dfd
+        } else {
0b2dfd
+          process_answer(channel, buf, (int)read_len, i, 0, now);
0b2dfd
+        }
0b2dfd
+      } while (read_len >= 0);
0b2dfd
     }
0b2dfd
 }
0b2dfd
 
0b2dfd
-- 
0b2dfd
2.38.1
0b2dfd