[krbdev.mit.edu #8809] Do not call getaddrinfo() with invalid hostnames
Greg Hudson via RT
rt-comment at KRBDEV-PROD-APP-1.mit.edu
Fri May 24 01:56:12 EDT 2019
This seems reasonable. I did a few minutes of research to see if we'd
be breaking any IDN scenarios, and I don't think so. We don't pass
AI_IDN to getaddrinfo(), so getaddrinfo won't be doing any encoding
into ACE, and we obviously don't do our own encoding. An application
could, in theory, encode an IDN to ACE before importing a GSS name, but
if it does that then hostname validation will succeed.
More information about the krb5-bugs
mailing list