Bug #39153 Failing to lookup a host name can lead to crash in current IPv6 implementation
Submitted: 1 Sep 2008 12:05 Modified: 20 Oct 2008 2:47
Reporter: Kristofer Pettersson
Status: Closed
Category:Server Severity:S3 (Non-critical)
Version:6.0-bzr OS:Any
Assigned to: Kristofer Pettersson Target Version:6.0-beta
Triage: Triaged: D1 (Critical)

[1 Sep 2008 12:05] Kristofer Pettersson 
Description:
The reverse name lookup used to ensure the server that the client is who it says to be can
fail. When it does it crashes because of an additional freeaddrinfo on an uninitialized
structure.

When a host name is added to the host name cache we do a memcpy on sockaddr_storage
structures but uses the size of struct addrinfo. This also caused a crash.

This bug report is spawed from http://bugs.mysql.com/bug.php?id=38804 

How to repeat:
memcpy bug is undeterministic.

The reverse name lookup bug was discovered when I used a dyndns service, and at the same
time my ISPs name service refused requests.
[1 Sep 2008 12:06] Bugs System 
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/52976

2810 Kristofer Pettersson	2008-09-01
      Bug#39153 Failing to lookup a host name can lead to crash in current IPv6
implementation
      
      The reverse name lookup used to ensure the server that the client is who it says to
be can
      fail. When it does it crashes because of an additional freeaddrinfo on an
uninitialized
      structure.
      
      When a host name is added to the host name cache we do a memcpy on sockaddr_storage
      structures but uses the size of struct addrinfo. This also caused a crash.
[17 Oct 2008 18:44] Bugs System 
Pushed into 6.0.7-alpha  (revid:kpettersson@mysql.com-20080901101150-4ne74r8v0492vv42)
(version source revid:kpettersson@mysql.com-20080901101150-4ne74r8v0492vv42) (pib:5)
[20 Oct 2008 2:47] Paul DuBois 
Noted in 6.0.7 changelog.

Hostname lookup failure could lead to a server crash.