Correctly copy resolver address. Fixes bug #13028.

diff --git a/ChangeLog b/ChangeLog
index 432c0416d75e7cf7ef009dd47b108ecaefd0b100..3905a29b1f05184c0fd3b50069c4e8c9e1f02e31 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2013-10-14  Aurelien Jarno  <aurelien@aurel32.net>
+
+       [BZ #13028]
+       * res_send.c(__libc_res_nsend): Correctly copy the nameserver
+       address.
+
 2013-10-14  P. J. McDermott  <pj@pehjota.net>
 
        [BZ #832]

diff --git a/NEWS b/NEWS
index b6afde08b524aef9b36f7f48d71feb76822a4f63..156e98891f8f1f94b02432d9d03b5e113cd200ee 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -9,12 +9,13 @@ Version 2.19
 
 * The following bugs are resolved with this release:
 
-  156, 431, 832, 13982, 13985, 14155, 14547, 14699, 14910, 15048, 15362,
-  15400, 15427, 15522, 15531, 15532, 15608, 15609, 15610, 15632, 15640,
-  15680, 15681, 15723, 15734, 15735, 15736, 15748, 15749, 15754, 15760,
-  15764, 15797, 15844, 15847, 15849, 15855, 15856, 15857, 15859, 15867,
-  15886, 15887, 15890, 15892, 15893, 15895, 15897, 15905, 15909, 15919,
-  15921, 15923, 15939, 15963, 15966, 15988, 16032, 16034, 16036.
+  156, 431, 832, 13028, 13982, 13985, 14155, 14547, 14699, 14910, 15048,
+  15362, 15400, 15427, 15522, 15531, 15532, 15608, 15609, 15610, 15632,
+  15640, 15680, 15681, 15723, 15734, 15735, 15736, 15748, 15749, 15754,
+  15760, 15764, 15797, 15844, 15847, 15849, 15855, 15856, 15857, 15859,
+  15867, 15886, 15887, 15890, 15892, 15893, 15895, 15897, 15905, 15909,
+  15867, 15886, 15887, 15890, 15892, 15893, 15895, 15897, 15905, 15909,
+  15919, 15921, 15923, 15939, 15963, 15966, 15988, 16032, 16034, 16036.
 
 * CVE-2012-4412 The strcoll implementation caches indices and rules for
   large collation sequences to optimize multiple passes.  This cache

diff --git a/resolv/res_send.c b/resolv/res_send.c
index 5a73696e55595a13efbc55bed6f334b9d0c9806f..7f2e85f3240eb73845c56dab61ccb10ecd17de8f 100644 (file)
--- a/resolv/res_send.c
+++ b/resolv/res_send.c
@@ -441,7 +441,7 @@ __libc_res_nsend(res_state statp, const u_char *buf, int buflen,
                                    malloc(sizeof (struct sockaddr_in6));
                        if (EXT(statp).nsaddrs[n] != NULL) {
                                memset (mempcpy(EXT(statp).nsaddrs[n],
-                                               &statp->nsaddr_list[n],
+                                               &statp->nsaddr_list[ns],
                                                sizeof (struct sockaddr_in)),
                                        '\0',
                                        sizeof (struct sockaddr_in6)