00db10
Upstream commit:
00db10
00db10
commit e9db92d3acfe1822d56d11abcea5bfc4c41cf6ca
00db10
Author: Carlos O'Donell <carlos@systemhalted.org>
00db10
Date:   Tue Feb 16 21:26:37 2016 -0500
00db10
00db10
    CVE-2015-7547: getaddrinfo() stack-based buffer overflow (Bug 18665).
00db10
00db10
Index: b/resolv/nss_dns/dns-host.c
00db10
===================================================================
00db10
--- a/resolv/nss_dns/dns-host.c
00db10
+++ b/resolv/nss_dns/dns-host.c
00db10
@@ -1051,7 +1051,10 @@ gaih_getanswer_slice (const querybuf *an
00db10
   int h_namelen = 0;
00db10
 
00db10
   if (ancount == 0)
00db10
-    return NSS_STATUS_NOTFOUND;
00db10
+    {
00db10
+      *h_errnop = HOST_NOT_FOUND;
00db10
+      return NSS_STATUS_NOTFOUND;
00db10
+    }
00db10
 
00db10
   while (ancount-- > 0 && cp < end_of_message && had_error == 0)
00db10
     {
00db10
@@ -1228,7 +1231,14 @@ gaih_getanswer_slice (const querybuf *an
00db10
   /* Special case here: if the resolver sent a result but it only
00db10
      contains a CNAME while we are looking for a T_A or T_AAAA record,
00db10
      we fail with NOTFOUND instead of TRYAGAIN.  */
00db10
-  return canon == NULL ? NSS_STATUS_TRYAGAIN : NSS_STATUS_NOTFOUND;
00db10
+  if (canon != NULL)
00db10
+    {
00db10
+      *h_errnop = HOST_NOT_FOUND;
00db10
+      return NSS_STATUS_NOTFOUND;
00db10
+    }
00db10
+
00db10
+  *h_errnop = NETDB_INTERNAL;
00db10
+  return NSS_STATUS_TRYAGAIN;
00db10
 }
00db10
 
00db10
 
00db10
@@ -1242,11 +1252,101 @@ gaih_getanswer (const querybuf *answer1,
00db10
 
00db10
   enum nss_status status = NSS_STATUS_NOTFOUND;
00db10
 
00db10
+  /* Combining the NSS status of two distinct queries requires some
00db10
+     compromise and attention to symmetry (A or AAAA queries can be
00db10
+     returned in any order).  What follows is a breakdown of how this
00db10
+     code is expected to work and why. We discuss only SUCCESS,
00db10
+     TRYAGAIN, NOTFOUND and UNAVAIL, since they are the only returns
00db10
+     that apply (though RETURN and MERGE exist).  We make a distinction
00db10
+     between TRYAGAIN (recoverable) and TRYAGAIN' (not-recoverable).
00db10
+     A recoverable TRYAGAIN is almost always due to buffer size issues
00db10
+     and returns ERANGE in errno and the caller is expected to retry
00db10
+     with a larger buffer.
00db10
+
00db10
+     Lastly, you may be tempted to make significant changes to the
00db10
+     conditions in this code to bring about symmetry between responses.
00db10
+     Please don't change anything without due consideration for
00db10
+     expected application behaviour.  Some of the synthesized responses
00db10
+     aren't very well thought out and sometimes appear to imply that
00db10
+     IPv4 responses are always answer 1, and IPv6 responses are always
00db10
+     answer 2, but that's not true (see the implemetnation of send_dg
00db10
+     and send_vc to see response can arrive in any order, particlarly
00db10
+     for UDP). However, we expect it holds roughly enough of the time
00db10
+     that this code works, but certainly needs to be fixed to make this
00db10
+     a more robust implementation.
00db10
+
00db10
+     ----------------------------------------------
00db10
+     | Answer 1 Status /   | Synthesized | Reason |
00db10
+     | Answer 2 Status     | Status      |        |
00db10
+     |--------------------------------------------|
00db10
+     | SUCCESS/SUCCESS     | SUCCESS     | [1]    |
00db10
+     | SUCCESS/TRYAGAIN    | TRYAGAIN    | [5]    |
00db10
+     | SUCCESS/TRYAGAIN'   | SUCCESS     | [1]    |
00db10
+     | SUCCESS/NOTFOUND    | SUCCESS     | [1]    |
00db10
+     | SUCCESS/UNAVAIL     | SUCCESS     | [1]    |
00db10
+     | TRYAGAIN/SUCCESS    | TRYAGAIN    | [2]    |
00db10
+     | TRYAGAIN/TRYAGAIN   | TRYAGAIN    | [2]    |
00db10
+     | TRYAGAIN/TRYAGAIN'  | TRYAGAIN    | [2]    |
00db10
+     | TRYAGAIN/NOTFOUND   | TRYAGAIN    | [2]    |
00db10
+     | TRYAGAIN/UNAVAIL    | TRYAGAIN    | [2]    |
00db10
+     | TRYAGAIN'/SUCCESS   | SUCCESS     | [3]    |
00db10
+     | TRYAGAIN'/TRYAGAIN  | TRYAGAIN    | [3]    |
00db10
+     | TRYAGAIN'/TRYAGAIN' | TRYAGAIN'   | [3]    |
00db10
+     | TRYAGAIN'/NOTFOUND  | TRYAGAIN'   | [3]    |
00db10
+     | TRYAGAIN'/UNAVAIL   | UNAVAIL     | [3]    |
00db10
+     | NOTFOUND/SUCCESS    | SUCCESS     | [3]    |
00db10
+     | NOTFOUND/TRYAGAIN   | TRYAGAIN    | [3]    |
00db10
+     | NOTFOUND/TRYAGAIN'  | TRYAGAIN'   | [3]    |
00db10
+     | NOTFOUND/NOTFOUND   | NOTFOUND    | [3]    |
00db10
+     | NOTFOUND/UNAVAIL    | UNAVAIL     | [3]    |
00db10
+     | UNAVAIL/SUCCESS     | UNAVAIL     | [4]    |
00db10
+     | UNAVAIL/TRYAGAIN    | UNAVAIL     | [4]    |
00db10
+     | UNAVAIL/TRYAGAIN'   | UNAVAIL     | [4]    |
00db10
+     | UNAVAIL/NOTFOUND    | UNAVAIL     | [4]    |
00db10
+     | UNAVAIL/UNAVAIL     | UNAVAIL     | [4]    |
00db10
+     ----------------------------------------------
00db10
+
00db10
+     [1] If the first response is a success we return success.
00db10
+         This ignores the state of the second answer and in fact
00db10
+         incorrectly sets errno and h_errno to that of the second
00db10
+	 answer.  However because the response is a success we ignore
00db10
+	 *errnop and *h_errnop (though that means you touched errno on
00db10
+         success).  We are being conservative here and returning the
00db10
+         likely IPv4 response in the first answer as a success.
00db10
+
00db10
+     [2] If the first response is a recoverable TRYAGAIN we return
00db10
+	 that instead of looking at the second response.  The
00db10
+	 expectation here is that we have failed to get an IPv4 response
00db10
+	 and should retry both queries.
00db10
+
00db10
+     [3] If the first response was not a SUCCESS and the second
00db10
+	 response is not NOTFOUND (had a SUCCESS, need to TRYAGAIN,
00db10
+	 or failed entirely e.g. TRYAGAIN' and UNAVAIL) then use the
00db10
+	 result from the second response, otherwise the first responses
00db10
+	 status is used.  Again we have some odd side-effects when the
00db10
+	 second response is NOTFOUND because we overwrite *errnop and
00db10
+	 *h_errnop that means that a first answer of NOTFOUND might see
00db10
+	 its *errnop and *h_errnop values altered.  Whether it matters
00db10
+	 in practice that a first response NOTFOUND has the wrong
00db10
+	 *errnop and *h_errnop is undecided.
00db10
+
00db10
+     [4] If the first response is UNAVAIL we return that instead of
00db10
+	 looking at the second response.  The expectation here is that
00db10
+	 it will have failed similarly e.g. configuration failure.
00db10
+
00db10
+     [5] Testing this code is complicated by the fact that truncated
00db10
+	 second response buffers might be returned as SUCCESS if the
00db10
+	 first answer is a SUCCESS.  To fix this we add symmetry to
00db10
+	 TRYAGAIN with the second response.  If the second response
00db10
+	 is a recoverable error we now return TRYAGIN even if the first
00db10
+	 response was SUCCESS.  */
00db10
+
00db10
   if (anslen1 > 0)
00db10
     status = gaih_getanswer_slice(answer1, anslen1, qname,
00db10
 				  &pat, &buffer, &buflen,
00db10
 				  errnop, h_errnop, ttlp,
00db10
 				  &first);
00db10
+
00db10
   if ((status == NSS_STATUS_SUCCESS || status == NSS_STATUS_NOTFOUND
00db10
        || (status == NSS_STATUS_TRYAGAIN
00db10
 	   /* We want to look at the second answer in case of an
00db10
@@ -1262,8 +1362,15 @@ gaih_getanswer (const querybuf *answer1,
00db10
 						     &pat, &buffer, &buflen,
00db10
 						     errnop, h_errnop, ttlp,
00db10
 						     &first);
00db10
+      /* Use the second response status in some cases.  */
00db10
       if (status != NSS_STATUS_SUCCESS && status2 != NSS_STATUS_NOTFOUND)
00db10
 	status = status2;
00db10
+      /* Do not return a truncated second response (unless it was
00db10
+         unavoidable e.g. unrecoverable TRYAGAIN).  */
00db10
+      if (status == NSS_STATUS_SUCCESS
00db10
+	  && (status2 == NSS_STATUS_TRYAGAIN
00db10
+	      && *errnop == ERANGE && *h_errnop != NO_RECOVERY))
00db10
+	status = NSS_STATUS_TRYAGAIN;
00db10
     }
00db10
 
00db10
   return status;
00db10
Index: b/resolv/res_query.c
00db10
===================================================================
00db10
--- a/resolv/res_query.c
00db10
+++ b/resolv/res_query.c
00db10
@@ -396,6 +396,7 @@ __libc_res_nsearch(res_state statp,
00db10
 		  {
00db10
 		    free (*answerp2);
00db10
 		    *answerp2 = NULL;
00db10
+		    *nanswerp2 = 0;
00db10
 		    *answerp2_malloced = 0;
00db10
 		  }
00db10
 	}
00db10
@@ -436,6 +437,7 @@ __libc_res_nsearch(res_state statp,
00db10
 			  {
00db10
 			    free (*answerp2);
00db10
 			    *answerp2 = NULL;
00db10
+			    *nanswerp2 = 0;
00db10
 			    *answerp2_malloced = 0;
00db10
 			  }
00db10
 
00db10
@@ -510,6 +512,7 @@ __libc_res_nsearch(res_state statp,
00db10
 	  {
00db10
 	    free (*answerp2);
00db10
 	    *answerp2 = NULL;
00db10
+	    *nanswerp2 = 0;
00db10
 	    *answerp2_malloced = 0;
00db10
 	  }
00db10
 	if (saved_herrno != -1)
00db10
Index: b/resolv/res_send.c
00db10
===================================================================
00db10
--- a/resolv/res_send.c
00db10
+++ b/resolv/res_send.c
00db10
@@ -1,3 +1,20 @@
00db10
+/* Copyright (C) 2016 Free Software Foundation, Inc.
00db10
+   This file is part of the GNU C Library.
00db10
+
00db10
+   The GNU C Library is free software; you can redistribute it and/or
00db10
+   modify it under the terms of the GNU Lesser General Public
00db10
+   License as published by the Free Software Foundation; either
00db10
+   version 2.1 of the License, or (at your option) any later version.
00db10
+
00db10
+   The GNU C Library is distributed in the hope that it will be useful,
00db10
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
00db10
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
00db10
+   Lesser General Public License for more details.
00db10
+
00db10
+   You should have received a copy of the GNU Lesser General Public
00db10
+   License along with the GNU C Library; if not, see
00db10
+   <http://www.gnu.org/licenses/>.  */
00db10
+
00db10
 /*
00db10
  * Copyright (c) 1985, 1989, 1993
00db10
  *    The Regents of the University of California.  All rights reserved.
00db10
@@ -360,6 +377,8 @@ __libc_res_nsend(res_state statp, const
00db10
 #ifdef USE_HOOKS
00db10
 	if (__builtin_expect (statp->qhook || statp->rhook, 0)) {
00db10
 		if (anssiz < MAXPACKET && ansp) {
00db10
+			/* Always allocate MAXPACKET, callers expect
00db10
+			   this specific size.  */
00db10
 			u_char *buf = malloc (MAXPACKET);
00db10
 			if (buf == NULL)
00db10
 				return (-1);
00db10
@@ -653,6 +672,77 @@ libresolv_hidden_def (res_nsend)
00db10
 
00db10
 /* Private */
00db10
 
00db10
+/* The send_vc function is responsible for sending a DNS query over TCP
00db10
+   to the nameserver numbered NS from the res_state STATP i.e.
00db10
+   EXT(statp).nssocks[ns].  The function supports sending both IPv4 and
00db10
+   IPv6 queries at the same serially on the same socket.
00db10
+
00db10
+   Please note that for TCP there is no way to disable sending both
00db10
+   queries, unlike UDP, which honours RES_SNGLKUP and RES_SNGLKUPREOP
00db10
+   and sends the queries serially and waits for the result after each
00db10
+   sent query.  This implemetnation should be corrected to honour these
00db10
+   options.
00db10
+
00db10
+   Please also note that for TCP we send both queries over the same
00db10
+   socket one after another.  This technically violates best practice
00db10
+   since the server is allowed to read the first query, respond, and
00db10
+   then close the socket (to service another client).  If the server
00db10
+   does this, then the remaining second query in the socket data buffer
00db10
+   will cause the server to send the client an RST which will arrive
00db10
+   asynchronously and the client's OS will likely tear down the socket
00db10
+   receive buffer resulting in a potentially short read and lost
00db10
+   response data.  This will force the client to retry the query again,
00db10
+   and this process may repeat until all servers and connection resets
00db10
+   are exhausted and then the query will fail.  It's not known if this
00db10
+   happens with any frequency in real DNS server implementations.  This
00db10
+   implementation should be corrected to use two sockets by default for
00db10
+   parallel queries.
00db10
+
00db10
+   The query stored in BUF of BUFLEN length is sent first followed by
00db10
+   the query stored in BUF2 of BUFLEN2 length.  Queries are sent
00db10
+   serially on the same socket.
00db10
+
00db10
+   Answers to the query are stored firstly in *ANSP up to a max of
00db10
+   *ANSSIZP bytes.  If more than *ANSSIZP bytes are needed and ANSCP
00db10
+   is non-NULL (to indicate that modifying the answer buffer is allowed)
00db10
+   then malloc is used to allocate a new response buffer and ANSCP and
00db10
+   ANSP will both point to the new buffer.  If more than *ANSSIZP bytes
00db10
+   are needed but ANSCP is NULL, then as much of the response as
00db10
+   possible is read into the buffer, but the results will be truncated.
00db10
+   When truncation happens because of a small answer buffer the DNS
00db10
+   packets header feild TC will bet set to 1, indicating a truncated
00db10
+   message and the rest of the socket data will be read and discarded.
00db10
+
00db10
+   Answers to the query are stored secondly in *ANSP2 up to a max of
00db10
+   *ANSSIZP2 bytes, with the actual response length stored in
00db10
+   *RESPLEN2.  If more than *ANSSIZP bytes are needed and ANSP2
00db10
+   is non-NULL (required for a second query) then malloc is used to
00db10
+   allocate a new response buffer, *ANSSIZP2 is set to the new buffer
00db10
+   size and *ANSP2_MALLOCED is set to 1.
00db10
+
00db10
+   The ANSP2_MALLOCED argument will eventually be removed as the
00db10
+   change in buffer pointer can be used to detect the buffer has
00db10
+   changed and that the caller should use free on the new buffer.
00db10
+
00db10
+   Note that the answers may arrive in any order from the server and
00db10
+   therefore the first and second answer buffers may not correspond to
00db10
+   the first and second queries.
00db10
+
00db10
+   It is not supported to call this function with a non-NULL ANSP2
00db10
+   but a NULL ANSCP.  Put another way, you can call send_vc with a
00db10
+   single unmodifiable buffer or two modifiable buffers, but no other
00db10
+   combination is supported.
00db10
+
00db10
+   It is the caller's responsibility to free the malloc allocated
00db10
+   buffers by detecting that the pointers have changed from their
00db10
+   original values i.e. *ANSCP or *ANSP2 has changed.
00db10
+
00db10
+   If errors are encountered then *TERRNO is set to an appropriate
00db10
+   errno value and a zero result is returned for a recoverable error,
00db10
+   and a less-than zero result is returned for a non-recoverable error.
00db10
+
00db10
+   If no errors are encountered then *TERRNO is left unmodified and
00db10
+   a the length of the first response in bytes is returned.  */
00db10
 static int
00db10
 send_vc(res_state statp,
00db10
 	const u_char *buf, int buflen, const u_char *buf2, int buflen2,
00db10
@@ -662,11 +752,7 @@ send_vc(res_state statp,
00db10
 {
00db10
 	const HEADER *hp = (HEADER *) buf;
00db10
 	const HEADER *hp2 = (HEADER *) buf2;
00db10
-	u_char *ans = *ansp;
00db10
-	int orig_anssizp = *anssizp;
00db10
-	// XXX REMOVE
00db10
-	// int anssiz = *anssizp;
00db10
-	HEADER *anhp = (HEADER *) ans;
00db10
+	HEADER *anhp = (HEADER *) *ansp;
00db10
 	struct sockaddr_in6 *nsap = EXT(statp).nsaddrs[ns];
00db10
 	int truncating, connreset, resplen, n;
00db10
 	struct iovec iov[4];
00db10
@@ -742,6 +828,8 @@ send_vc(res_state statp,
00db10
 	 * Receive length & response
00db10
 	 */
00db10
 	int recvresp1 = 0;
00db10
+	/* Skip the second response if there is no second query.
00db10
+           To do that we mark the second response as received.  */
00db10
 	int recvresp2 = buf2 == NULL;
00db10
 	uint16_t rlen16;
00db10
  read_len:
00db10
@@ -778,33 +866,14 @@ send_vc(res_state statp,
00db10
 	u_char **thisansp;
00db10
 	int *thisresplenp;
00db10
 	if ((recvresp1 | recvresp2) == 0 || buf2 == NULL) {
00db10
+		/* We have not received any responses
00db10
+		   yet or we only have one response to
00db10
+		   receive.  */
00db10
 		thisanssizp = anssizp;
00db10
 		thisansp = anscp ?: ansp;
00db10
 		assert (anscp != NULL || ansp2 == NULL);
00db10
 		thisresplenp = &resplen;
00db10
 	} else {
00db10
-		if (*anssizp != MAXPACKET) {
00db10
-			/* No buffer allocated for the first
00db10
-			   reply.  We can try to use the rest
00db10
-			   of the user-provided buffer.  */
00db10
-#ifdef _STRING_ARCH_unaligned
00db10
-			*anssizp2 = orig_anssizp - resplen;
00db10
-			*ansp2 = *ansp + resplen;
00db10
-#else
00db10
-			int aligned_resplen
00db10
-			  = ((resplen + __alignof__ (HEADER) - 1)
00db10
-			     & ~(__alignof__ (HEADER) - 1));
00db10
-			*anssizp2 = orig_anssizp - aligned_resplen;
00db10
-			*ansp2 = *ansp + aligned_resplen;
00db10
-#endif
00db10
-		} else {
00db10
-			/* The first reply did not fit into the
00db10
-			   user-provided buffer.  Maybe the second
00db10
-			   answer will.  */
00db10
-			*anssizp2 = orig_anssizp;
00db10
-			*ansp2 = *ansp;
00db10
-		}
00db10
-
00db10
 		thisanssizp = anssizp2;
00db10
 		thisansp = ansp2;
00db10
 		thisresplenp = resplen2;
00db10
@@ -812,10 +881,14 @@ send_vc(res_state statp,
00db10
 	anhp = (HEADER *) *thisansp;
00db10
 
00db10
 	*thisresplenp = rlen;
00db10
-	if (rlen > *thisanssizp) {
00db10
-		/* Yes, we test ANSCP here.  If we have two buffers
00db10
-		   both will be allocatable.  */
00db10
-		if (__builtin_expect (anscp != NULL, 1)) {
00db10
+	/* Is the answer buffer too small?  */
00db10
+	if (*thisanssizp < rlen) {
00db10
+		/* If the current buffer is non-NULL and it's not
00db10
+		   pointing at the static user-supplied buffer then
00db10
+		   we can reallocate it.  */
00db10
+		if (thisansp != NULL && thisansp != ansp) {
00db10
+			/* Always allocate MAXPACKET, callers expect
00db10
+			   this specific size.  */
00db10
 			u_char *newp = malloc (MAXPACKET);
00db10
 			if (newp == NULL) {
00db10
 				*terrno = ENOMEM;
00db10
@@ -827,6 +900,9 @@ send_vc(res_state statp,
00db10
 			if (thisansp == ansp2)
00db10
 			  *ansp2_malloced = 1;
00db10
 			anhp = (HEADER *) newp;
00db10
+			/* A uint16_t can't be larger than MAXPACKET
00db10
+			   thus it's safe to allocate MAXPACKET but
00db10
+			   read RLEN bytes instead.  */
00db10
 			len = rlen;
00db10
 		} else {
00db10
 			Dprint(statp->options & RES_DEBUG,
00db10
@@ -990,6 +1066,66 @@ reopen (res_state statp, int *terrno, in
00db10
 	return 1;
00db10
 }
00db10
 
00db10
+/* The send_dg function is responsible for sending a DNS query over UDP
00db10
+   to the nameserver numbered NS from the res_state STATP i.e.
00db10
+   EXT(statp).nssocks[ns].  The function supports IPv4 and IPv6 queries
00db10
+   along with the ability to send the query in parallel for both stacks
00db10
+   (default) or serially (RES_SINGLKUP).  It also supports serial lookup
00db10
+   with a close and reopen of the socket used to talk to the server
00db10
+   (RES_SNGLKUPREOP) to work around broken name servers.
00db10
+
00db10
+   The query stored in BUF of BUFLEN length is sent first followed by
00db10
+   the query stored in BUF2 of BUFLEN2 length.  Queries are sent
00db10
+   in parallel (default) or serially (RES_SINGLKUP or RES_SNGLKUPREOP).
00db10
+
00db10
+   Answers to the query are stored firstly in *ANSP up to a max of
00db10
+   *ANSSIZP bytes.  If more than *ANSSIZP bytes are needed and ANSCP
00db10
+   is non-NULL (to indicate that modifying the answer buffer is allowed)
00db10
+   then malloc is used to allocate a new response buffer and ANSCP and
00db10
+   ANSP will both point to the new buffer.  If more than *ANSSIZP bytes
00db10
+   are needed but ANSCP is NULL, then as much of the response as
00db10
+   possible is read into the buffer, but the results will be truncated.
00db10
+   When truncation happens because of a small answer buffer the DNS
00db10
+   packets header feild TC will bet set to 1, indicating a truncated
00db10
+   message, while the rest of the UDP packet is discarded.
00db10
+
00db10
+   Answers to the query are stored secondly in *ANSP2 up to a max of
00db10
+   *ANSSIZP2 bytes, with the actual response length stored in
00db10
+   *RESPLEN2.  If more than *ANSSIZP bytes are needed and ANSP2
00db10
+   is non-NULL (required for a second query) then malloc is used to
00db10
+   allocate a new response buffer, *ANSSIZP2 is set to the new buffer
00db10
+   size and *ANSP2_MALLOCED is set to 1.
00db10
+
00db10
+   The ANSP2_MALLOCED argument will eventually be removed as the
00db10
+   change in buffer pointer can be used to detect the buffer has
00db10
+   changed and that the caller should use free on the new buffer.
00db10
+
00db10
+   Note that the answers may arrive in any order from the server and
00db10
+   therefore the first and second answer buffers may not correspond to
00db10
+   the first and second queries.
00db10
+
00db10
+   It is not supported to call this function with a non-NULL ANSP2
00db10
+   but a NULL ANSCP.  Put another way, you can call send_vc with a
00db10
+   single unmodifiable buffer or two modifiable buffers, but no other
00db10
+   combination is supported.
00db10
+
00db10
+   It is the caller's responsibility to free the malloc allocated
00db10
+   buffers by detecting that the pointers have changed from their
00db10
+   original values i.e. *ANSCP or *ANSP2 has changed.
00db10
+
00db10
+   If an answer is truncated because of UDP datagram DNS limits then
00db10
+   *V_CIRCUIT is set to 1 and the return value non-zero to indicate to
00db10
+   the caller to retry with TCP.  The value *GOTSOMEWHERE is set to 1
00db10
+   if any progress was made reading a response from the nameserver and
00db10
+   is used by the caller to distinguish between ECONNREFUSED and
00db10
+   ETIMEDOUT (the latter if *GOTSOMEWHERE is 1).
00db10
+
00db10
+   If errors are encountered then *TERRNO is set to an appropriate
00db10
+   errno value and a zero result is returned for a recoverable error,
00db10
+   and a less-than zero result is returned for a non-recoverable error.
00db10
+
00db10
+   If no errors are encountered then *TERRNO is left unmodified and
00db10
+   a the length of the first response in bytes is returned.  */
00db10
 static int
00db10
 send_dg(res_state statp,
00db10
 	const u_char *buf, int buflen, const u_char *buf2, int buflen2,
00db10
@@ -999,8 +1135,6 @@ send_dg(res_state statp,
00db10
 {
00db10
 	const HEADER *hp = (HEADER *) buf;
00db10
 	const HEADER *hp2 = (HEADER *) buf2;
00db10
-	u_char *ans = *ansp;
00db10
-	int orig_anssizp = *anssizp;
00db10
 	struct timespec now, timeout, finish;
00db10
 	struct pollfd pfd[1];
00db10
 	int ptimeout;
00db10
@@ -1033,6 +1167,8 @@ send_dg(res_state statp,
00db10
 	int need_recompute = 0;
00db10
 	int nwritten = 0;
00db10
 	int recvresp1 = 0;
00db10
+	/* Skip the second response if there is no second query.
00db10
+           To do that we mark the second response as received.  */
00db10
 	int recvresp2 = buf2 == NULL;
00db10
 	pfd[0].fd = EXT(statp).nssocks[ns];
00db10
 	pfd[0].events = POLLOUT;
00db10
@@ -1196,52 +1332,54 @@ send_dg(res_state statp,
00db10
 		int *thisresplenp;
00db10
 
00db10
 		if ((recvresp1 | recvresp2) == 0 || buf2 == NULL) {
00db10
+			/* We have not received any responses
00db10
+			   yet or we only have one response to
00db10
+			   receive.  */
00db10
 			thisanssizp = anssizp;
00db10
 			thisansp = anscp ?: ansp;
00db10
 			assert (anscp != NULL || ansp2 == NULL);
00db10
 			thisresplenp = &resplen;
00db10
 		} else {
00db10
-			if (*anssizp != MAXPACKET) {
00db10
-				/* No buffer allocated for the first
00db10
-				   reply.  We can try to use the rest
00db10
-				   of the user-provided buffer.  */
00db10
-#ifdef _STRING_ARCH_unaligned
00db10
-				*anssizp2 = orig_anssizp - resplen;
00db10
-				*ansp2 = *ansp + resplen;
00db10
-#else
00db10
-				int aligned_resplen
00db10
-				  = ((resplen + __alignof__ (HEADER) - 1)
00db10
-				     & ~(__alignof__ (HEADER) - 1));
00db10
-				*anssizp2 = orig_anssizp - aligned_resplen;
00db10
-				*ansp2 = *ansp + aligned_resplen;
00db10
-#endif
00db10
-			} else {
00db10
-				/* The first reply did not fit into the
00db10
-				   user-provided buffer.  Maybe the second
00db10
-				   answer will.  */
00db10
-				*anssizp2 = orig_anssizp;
00db10
-				*ansp2 = *ansp;
00db10
-			}
00db10
-
00db10
 			thisanssizp = anssizp2;
00db10
 			thisansp = ansp2;
00db10
 			thisresplenp = resplen2;
00db10
 		}
00db10
 
00db10
 		if (*thisanssizp < MAXPACKET
00db10
-		    /* Yes, we test ANSCP here.  If we have two buffers
00db10
-		       both will be allocatable.  */
00db10
-		    && anscp
00db10
+		    /* If the current buffer is non-NULL and it's not
00db10
+		       pointing at the static user-supplied buffer then
00db10
+		       we can reallocate it.  */
00db10
+		    && (thisansp != NULL && thisansp != ansp)
00db10
+		    /* Is the size too small?  */
00db10
 		    && (ioctl (pfd[0].fd, FIONREAD, thisresplenp) < 0
00db10
-			|| *thisanssizp < *thisresplenp)) {
00db10
+			|| *thisanssizp < *thisresplenp)
00db10
+		    ) {
00db10
+			/* Always allocate MAXPACKET, callers expect
00db10
+			   this specific size.  */
00db10
 			u_char *newp = malloc (MAXPACKET);
00db10
 			if (newp != NULL) {
00db10
-				*anssizp = MAXPACKET;
00db10
-				*thisansp = ans = newp;
00db10
+				*thisanssizp = MAXPACKET;
00db10
+				*thisansp = newp;
00db10
 				if (thisansp == ansp2)
00db10
 				  *ansp2_malloced = 1;
00db10
 			}
00db10
 		}
00db10
+		/* We could end up with truncation if anscp was NULL
00db10
+		   (not allowed to change caller's buffer) and the
00db10
+		   response buffer size is too small.  This isn't a
00db10
+		   reliable way to detect truncation because the ioctl
00db10
+		   may be an inaccurate report of the UDP message size.
00db10
+		   Therefore we use this only to issue debug output.
00db10
+		   To do truncation accurately with UDP we need
00db10
+		   MSG_TRUNC which is only available on Linux.  We
00db10
+		   can abstract out the Linux-specific feature in the
00db10
+		   future to detect truncation.  */
00db10
+		if (__glibc_unlikely (*thisanssizp < *thisresplenp)) {
00db10
+			Dprint(statp->options & RES_DEBUG,
00db10
+			       (stdout, ";; response may be truncated (UDP)\n")
00db10
+			);
00db10
+		}
00db10
+
00db10
 		HEADER *anhp = (HEADER *) *thisansp;
00db10
 		socklen_t fromlen = sizeof(struct sockaddr_in6);
00db10
 		assert (sizeof(from) <= fromlen);