[17244] in Kerberos-V5-bugs
[krbdev.mit.edu #9283] configure: gethostbyname_r return-type checks
daemon@ATHENA.MIT.EDU (Will Hicks via RT)
Wed Nov 11 02:04:26 2026
From: "Will Hicks via RT" <rt-comment@krbdev.mit.edu>
In-Reply-To: <DS4PR10MB997768BB61AF6AF4CCBE58899196722@DS4PR10MB997768.namprd10.prod.outlook.com>
Message-ID: <rt-4.4.3-2-3336210-1794380658-1367.9283-4-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9283":;
Date: Wed, 11 Nov 2026 02:04:18 -0500
MIME-Version: 1.0
Reply-To: rt-comment@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
Wed Nov 11 02:04:18 2026: Request 9283 was acted upon.
Transaction: Ticket created by will.hicks@blackline.com
Queue: krb5
Subject: configure: gethostbyname_r return-type checks fail under C23 (gcc 15), causing non-reentrant gethostbyname() use on musl
Owner: Nobody
Requestors: will.hicks@blackline.com
Status: new
Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9283 >
The gethostbyname_r return-type tests in src/configure.ac declare the
function with an empty parameter list:
#include <netdb.h>
extern int gethostbyname_r();
...
extern struct hostent *gethostbyname_r();
In C23 (gcc 15's default, -std=gnu23), "()" means "no parameters", so
both declarations conflict with the real prototype in <netdb.h> and
fail to compile. configure then reports "cannot determine return type
of gethostbyname_r -- disabling", and HAVE_GETHOSTBYNAME_R is left
undefined.
On musl, src/util/support/fake-addrinfo.c also defines
COPY_FIRST_CANONNAME (since __GLIBC_PREREQ is not available), and the
getaddrinfo wrapper falls back to the non-reentrant gethostbyname().
When several threads call gss_init_sec_context() at once, the shared
hostent result is freed twice, and musl's allocator aborts the process
(SIGSEGV).
- Observed with krb5 1.22.1 on Alpine Linux 3.23 (gcc 15, musl 1.2.5).
- The same check appears unchanged in 1.22.3 and on master.
- The Alpine 3.22 build of 1.21.3, compiled with gcc 14 / C17, is not
affected.
- glibc builds don't take this code path.
Suggested fix: declare full prototypes in the test programs, matching
the glibc and Solaris signatures, or detect the return type with a test
that doesn't rely on unprototyped declarations.
Downstream reports:
https://gitlab.alpinelinux.org/alpine/aports/-/work_items/18185
https://github.com/dotnet/runtime/issues/123782
https://github.com/home-operations/containers/pull/2113
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
