Glibc getaddrinfo stack-based buffer overflow

Re:Glibc getaddrinfo stack-based buffer overflow by lmm on Tuesday February 16, 2016 @12:03PM (#11111266)

The JVM looks to have its own implementation. I imagine .net would be the same. There's ocaml-dns for unikernel-deployed OCaml.

A managed language generally doesn't give you direct access to syscalls at all. In rust you can perform them without having to go via C.

[ Parent | on HN ]

Re:Glibc getaddrinfo stack-based buffer overflow by zwetan on Tuesday February 16, 2016 @01:50PM (#11112163)

With Redtamarin (based on AVM2), there is a native library which sole purpose is to give direct access to C and other syscalls.

For ex with getaddrinfo: https://gist.github.com/zwetan/0c047d36542cc6979652

I know because I did it on purpose, even if it managed code written in AS3 you don't want to reinvent getaddrinfo, you want to reuse it "as is" as much as possible.

[ Parent | on HN ]

Re:Glibc getaddrinfo stack-based buffer overflow by gpderetta on Tuesday February 16, 2016 @12:45PM (#11111660)

Note that DNS lookup doesn't require any syscall other than normal socket i/o, which is available on any non toy language.

One possible reason why java might implements its own name resolution is because it wants to do async name resolution which is not possible (at least portably) via getaddrinfo and friends.

[ Parent | on HN ]

Re:Glibc getaddrinfo stack-based buffer overflow by spc476 on Wednesday February 17, 2016 @12:48AM (#11115623)

Yes, but you still need to encode the questions and decode the answers. Existing libraries that do this are pretty dismal.

(Dismal enough that I ended up writing my own DNS encoding/decoding library (https://github.com/spc476/SPCDNS) with the aim of being easy to use as well as safe. It assumes nothing about the incoming packet and does extensive validation (enough that it found bugs in other DNS libraries). It also avoids dynamic memory allocations. It's used at work in two projects that get heavy use (millions of DNS queries a day) and so far has performed without incident, so well written C code is possible.)

[ Parent | on HN ]