CVE-2022-4904: Input Validation

A flaw was found in the c-ares package. The aressetsortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.

In aressetsortlist, it calls configsortlist(..., sortstr) to parse the input str and initialize a sortlist configuration. However, aressetsortlist has not any checks about the validity of the input str. It is very easy to create an arbitrary length stack overflow with the unchecked memcpy(ipbuf, str, q-str); and memcpy(ipbufpfx, str, q-str); statements in the configsortlist call, which could potentially cause severe security impact in practical programs.

— Red Hat