Glibc getaddrinfo stack-based buffer overflow

Re:Glibc getaddrinfo stack-based buffer overflow by gpderetta on Tuesday February 16, 2016 @12:45PM (#11111660)

Note that DNS lookup doesn't require any syscall other than normal socket i/o, which is available on any non toy language.

One possible reason why java might implements its own name resolution is because it wants to do async name resolution which is not possible (at least portably) via getaddrinfo and friends.

[ Parent | on HN ]

Re:Glibc getaddrinfo stack-based buffer overflow by spc476 on Wednesday February 17, 2016 @12:48AM (#11115623)

Yes, but you still need to encode the questions and decode the answers. Existing libraries that do this are pretty dismal.

(Dismal enough that I ended up writing my own DNS encoding/decoding library (https://github.com/spc476/SPCDNS) with the aim of being easy to use as well as safe. It assumes nothing about the incoming packet and does extensive validation (enough that it found bugs in other DNS libraries). It also avoids dynamic memory allocations. It's used at work in two projects that get heavy use (millions of DNS queries a day) and so far has performed without incident, so well written C code is possible.)

[ Parent | on HN ]