The full changelog of the c-ares project's history.

Security:

• CVE-2023-32067. High. 0-byte UDP payload causes Denial of Service
• CVE-2023-31147 Moderate. Insufficient randomness in generation of DNS query IDs
• CVE-2023-31130. Moderate. Buffer Underwrite in ares_inet_net_pton()
• CVE-2023-31124. Low. AutoTools does not set CARES_RANDOM_FILE during cross compilation

Bug fixes:

• Fix uninitialized memory warning in test
• Turn off IPV6_V6ONLY on Windows to allow IPv4-mapped IPv6 addresses
• ares_getaddrinfo() should allow a port of 0
• Fix memory leak in ares_send() on error
• Fix comment style in ares_data.h
• Remove unneeded ifdef for Windows
• Fix typo in ares_init_options.3
• Re-add support for Watcom compiler
• Sync ax_pthread.m4 with upstream
• Windows: Invalid stack variable used out of scope for HOSTS path
• Sync ax_cxx_compile_stdcxx_11.m4 with upstream to fix uclibc support

Security:

• Low. Stack overflow in ares_set_sortlist() which is used during c-ares initialization and typically provided by an administrator and not an end user.

Changes:

• Windows: Drop support for XP and derivatives which greatly cleans up initialization code.
• Add ARES_OPT_HOSTS_FILE similar to ARES_OPT_RESOLVCONF for specifying a custom hosts file location.
• Add vcpkg installation instructions

Bug fixes:

• Fix cross-compilation from Windows to Linux due to CPACK logic.
• Fix memory leak in reading /etc/hosts when using localhost fallback.
• Fix chain building c-ares when libresolv is already included by another project
• File lookup should not immediately abort as there may be other tries due to search criteria.
• Asterisks should be allowed in host validation as CNAMEs may reference wildcard domains
• AutoTools build system referenced bad STDC_HEADERS macro
• Even if one address class returns a failure for ares_getaddrinfo() we should still return the results we have
• CMake Windows: DLLs did not include resource file to include versions
• CMake: Guard target creation in exported config
• Fix ares_getaddrinfo() numerical address resolution with AF_UNSPEC
• Apple: fix libresolv configured query times.
• Fix tools and help information
• Various documentation fixes and cleanups
• Add include guards to ares_data.h
• c-ares could try to exceed maximum number of iovec entries supported by system
• CMake package config generation allow for absolute install paths
• Intel compiler fixes
• ares_strsplit bugs
• The RFC6761 6.3 states localhost subdomains must be offline too.

Bug fixes:

• ares_getaddrinfo() would return ai_addrlen of 16 for ipv6 adddresses rather than the sizeof(struct sockaddr_in6)

Changes:

• Add support for URI(Uniform Resource Identifier) records via ares_parse_uri_reply()
• Provide ares_nameser.h as a public interface as needed by NodeJS
• Update URLs from c-ares.haxx.se to c-ares.org
• During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so that the search process will continue to the next domain in the search.
• Turn ares_gethostbyname() into a wrapper for ares_getaddrinfo() as they followed very similar code paths and ares_gethostbyaddr() has some more desirable features such as priority sorting and parallel queries for AF_UNSPEC.
• ares_getaddrinfo() now contains a name element in the address info structure as the last element. This is not an API or ABI break due to the structure always being internally allocated and it being the last element.
• ares_parse_a_reply() and ares_parse_aaaa_reply() were nearly identical, those now use the same helper functions for parsing rather than having their own code.
• RFC6761 Section 6.3 says "localhost" lookups need to be special cased to return loopback addresses, and not forward queries to recursive dns servers. On Windows this now returns all loopback addresses, on other systems it returns 127.0.0.1 or ::1 always, and will never forward a request for "localhost" to outside DNS servers.
• Haiki: port

Bug fixes:

• add build to .gitignore
• z/OS minor update, add missing semicolon in ares_init.c
• Fix building when latest ax_code_coverage.m4 is imported
• Work around autotools 'error: too many loops' and other newer autotools import related bugs.
• MinGW cross builds need advapi32 link as lower case
• Cygwin build fix due to containing both socket.h and winsock2.h
• ares_expand_name should allow underscores (_) as SRV records legitimately use them
• Allow '/' as a valid character for a returned name for CNAME in-addr.arpa delegation
• ares_getaddrinfo() was not honoring HOSTALIASES
• ares_getaddrinfo() had some test cases disabled due to a bug in the test framework itself which has now been resolved

Security:

• NodeJS passes NULL for addr and 0 for addrlen to ares_parse_ptr_reply() on systems where malloc(0) returns NULL. This would cause a crash.
• When building c-ares with CMake, the RANDOM_FILE would not be set and therefore downgrade to the less secure random number generator
• If ares_getaddrinfo() was terminated by an ares_destroy(), it would cause a crash
• Crash in sortaddrinfo() if the list size equals 0 due to an unexpected DNS response
• Expand number of escaped characters in DNS replies as per RFC1035 5.1 to prevent spoofing follow-up
• Perform validation on hostnames to prevent possible XSS due to applications not performing valiation themselves

Changes:

• Use non-blocking /dev/urandom for random data to prevent early startup performance issues
• z/OS port
• ares_malloc(0) is now defined behavior (returns NULL) rather than system-specific to catch edge cases

Bug fixes:

• Fuzz testing files were not distributed with official archives
• Building tests should not force building of static libraries except on Windows
• Windows builds of the tools would fail if built as static due to a missing CARES_STATICLIB definition
• Relative headers must use double quotes to prevent pulling in a system library
• Fix OpenBSD building by implementing portability updates for including arpa/nameser.h
• Fix building out-of-tree for autotools
• Make install on MacOS/iOS with CMake was missing the bundle destination so libraries weren't actually installed
• Fix retrieving DNS server configuration on MacOS and iOS if the configuration did not include search domains
• ares_parse_a_reply and ares_parse_aaa_reply were erroneously using strdup() instead of ares_strdup()

Fixes packaging issues in 1.17.0.

Security:

• avoid read-heap-buffer-overflow in ares_parse_soa_reply found during fuzzing
• Avoid theoretical buffer overflow in RC4 loop comparison
• Empty hquery->name could lead to invalid memory access
• ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was passed in

Changes:

• Update help information for adig, acountry, and ahost
• Test Suite now uses dynamic system-assigned ports rather than hardcoded ports to prevent failures in containers
• Detect remote DNS server does not support EDNS using rules from RFC 6891
• Source tree has been reorganized to use a more modern layout
• Allow parsing of CAA Resource Record

Bug fixes:

• readaddrinfo bad sizeof()
• Test cases should honor HAVE_WRITEV flag, not depend on WIN32
• FQDN with trailing period should be queried first
• ares_getaddrinfo() was returning members of the struct as garbage values if unset, and was not honoring ai_socktype and ai_protocol hints.
• ares_gethostbyname() with AF_UNSPEC and an ip address would fail
• Properly document ares_set_local_ip4() uses host byte order

Security:

• Prevent possible use-after-free and double-free in ares_getaddrinfo() if ares_destroy() is called prior to ares_getaddrinfo() completing. Reported by Jann Horn at Google Project Zero.

Changes:

• Allow TXT records on CHAOS qclass. Used for retriving things like version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]

Bug fixes:

• Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
• Silence false cast-align compiler warnings due to valid casts of struct sockaddr to struct sockaddr_in and struct sockaddr_in6.
• MacOS should use libresolv for retrieving DNS servers, like iOS
• CMake build system should populate the INCLUDE_DIRECTORIES property of installed targets [2]
• Correct macros in use for the ares_getaddrinfo.3 man page

Changes:

• Introduction of ares_getaddrinfo() API which provides similar output (including proper sorting as per RFC 6724) to the system native API, but utilizes different data structures in order to provide additional information such as TTLs and all aliases. Please reference the respective man pages for usage details.
• Parse SOA records from ns_t_any response
• CMake: Provide c-ares version in package export file
• CMake: Add CPACK functionality for DEB and RPM
• CMake: Generate PDB files during build
• CMake: Support manpage installation

Bug fixes:

• Fix bad expectation in IPv6 localhost test.
• AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to prevent complaints about CPPFLAGS in CFLAGS.
• Fix .onion handling
• Command line usage was out of date for adig and ahost.
• Typos in manpages
• If ares_getenv is defined, it must return a value on all platforms
• If /etc/resolv.conf has invalid lookup values, use the defaults.
• Tests: Separate live tests from SetServers* tests as only live tests should require internet access.
• ares_gethostbyname() should return ENODATA if no valid A or AAAA record is found, but a CNAME was found.
• CMake: Rework library function checking to prevent unintended linking with system libraries that aren't needed.
• Due to use of inet_addr() it was not possible to return 255.255.255.255 from ares_gethostbyname().
• CMake: Fix building of tests on Windows

Changes:

• Add ares_init_options() configurability for path to resolv.conf file
• Ability to exclude building of tools (adig, ahost, acountry) in CMake
• Android: Support for domain search suffix
• Report ARES_ENOTFOUND for .onion domain names as per RFC7686

Bug fixes:

• AIX build fix for trying to include both nameser_compat.h and onameser_compat.h
• Windows: Improve DNS suffixes extracting from WinNT registry
• Fix modern GCC warnings
• Apply the IPv6 server blacklist to all nameserver sources, not just Windows
• Fix warnings emitted by MSVC when using -W4
• Prevent changing name servers while queries are outstanding
• Harden and rationalize c-ares timeout computation
• Distribute ares_android.h
• ares_set_servers_csv() on failure should not leave channel in a bad state
• Add missing docs to distribution

Changes:

• android: Introduce new ares_library_init_android() call for Oreo support

Bug fixes:

• Fix patch for CVE-2017-1000381 to not be overly aggressive
• win32: Preserve DNS server order returned by Windows when sorting and exclude DNS servers in legacy subnets
• win32: Support most recent Visual Studio 2017
• gethostbyaddr should fail with ECANCELLED not ENOTFOUND when ares_cancel is called
• win32: Exclude legacy ipv6 subnets
• android: Applications compiled for Oreo can no longer use __system_property_get and must use Java calls to retrieve DNS servers
• win32: Force use of ANSI functions
• CMake minimum version is now 3.1
• ares_gethostbyname.3: fix callback status values
• docs: Document WSAStartup requirement
• Fix a typo in init_by_resolv_conf
• Android JNI code leaks local references in some cases
• Force using the ANSI versions of WinAPI functions

Changes:

• cmake build system support added
• Add virtual function set for socket IO: ares_set_socket_functions

Bug fixes:

• CVE-2017-1000381: c-ares NAPTR parser out of bounds access
• macos: do not set HAVE_CLOCK_GETTIME_MONOTONIC
• test: check ares_create_query with too-long name
• dist: add ares_library_initialized.* to the tarball
• fix build on OpenBSD
• dist: ship msvc_ver.inc too
• test: Add gTest/gMock files to SOURCES
• test: add fuzz entrypoint for ares_create_query()
• configure: clock_gettime workaround
• docs: convert INSTALL to MarkDown & tweak
• ares_process: fix return type of socket_create function (win32 warning)
• docs: fixed references to ares_set_local_ip4 and ares_set_local_ip6
• Windows DNS server sorting
• Use ares_socklen_t instead of socket_t
• ares_create_query: use ares_free not naked free
• msvc_ver.inc support most recent Visual Studio 2017
• acountry: Convert char from ISO-8859-1 to UTF-8
• ares_expand_name: limit number of indirections
• configure: do not check for ar if specified manually
• Added support for Windows DNS Suffix Search List
• ares.h: support compiling with QNX

Changes:

• api: add ARES_OPT_NOROTATE optmask value

Bug fixes:

• CVE-2016-5180: ares_create_query single byte out of buffer write
• configure: acknowledge --disable-tests [1]
• man pages: fix typos detected by Lintian
• test: add missing #includes for dns-proto.cc
• test: avoid in6addr_* constants
• test: Build with MinGW on AppVeyor
• Makefile.m32: add support for extra flags
• Makefile.m32: add support for CROSSPREFIX
• configure: check if tests can get built before enabled
• ares_library_cleanup: reset ares_realloc too
• ahost.c: add cast to fix C++ compile
• test: Only pass unused args to GoogleTest
• build: commonize MSVC version detection
• msvc_ver.inc: support Visual Studio 2015 Update 1, 2, 3
• test: for AF_UNSPEC, return CNAME only for AAAA, but valid A record
• ares_getnameinfo: explicitly clear struct servent before use
• test: Update fuzzing function prototype
• init: fix nsort initialization
• test: add fuzzing check script to tests
• web: http => https
• read_tcp_data: remove superfluous NULL check
• LICENSE.md: add a stand-alone license file
• SECURITY.md: suggested "security process" for the project
• ares_init_options: only propagate init failures from options [2]
• headers: remove checks for and defines of variable sizes
• test: fix gMock to work with gcc >= 6.x [3]

Changes:

• Add a unit test suite
• Allow builds with code converage with --enable-code-coverage configure option
• Allow library-wide override of malloc/free
• Allow multiple -s options to the ahost command
• api: Expose the ares_library_initialized() function
• api: Add ares_set_sortlist(3) entrypoint
• api: Add entrypoints to allow use of per-server ports
• api: introduce `ares_parse_txt_reply_ext`
• api: Add ares_set_socket_configure_callback()

Bug fixes:

• timeadd: make static
• timeoffset: made static and private
• nowarn: use instead of configure for size of long
• single_domain: Invalid memory access for empty string input
• ares_build.h: fix building on 64-bit powerpc
• Allow specification of search domain in ahost
• Don't override explicitly specified search domains
• ares_parse_soa_reply: Do not leak rr_name on allocation failure
• Update ahost man page to describe -s option
• host_callback: Fall back to AF_INET on searching with AF_UNSPEC
• Add -t u option to ahost
• CONTRIBUTING: added
• ares_set_servers_csv: fix NULL dereference
• Fix integer shift overflow if both tcp_socket and udp_socket are set
• fix acountry memory leak
• lookup_service: prevent tmpbuf from overrunning
• ares_getnameinfo.3: there is no ares_getaddrinfo
• init_by_defaults: Continue loop if space for hostname not large enough
• Destroy options if ares_save_options fails
• ares__read_line: free buf on realloc failure
• added define for visual studio 2013
• windows: fix slow DNS lookup issue
• Use libresolv to initialize cares on iPhone targets
• buildconf: remove check for libtool, it only requires libtoolize
• init_by_resolv_conf: Don't exit loop early leaving uninitialized entries
• ahost: check the select() return code
• configure_socket: explicitly ignore return code
• read_tcp_data: don't try to use NULL pointer after malloc failure
• Distribute all man pages
• ares_expand_name: check for valid bits in label length
• ares__read_line: clear buf pointer on realloc failure
• process_answer: fix things up correctly when removing EDNS option
• ares_parse_txt_reply: propagate errors from per-substring loop
• ares_gethostbyname: don't leak valid-but-empty hostent
• ares_init_options: don't lose init failure
• ares_dup: clear new channel on failure
• config_sortlist: free any existing sortlist on (re)alloc failure
• ares_striendstr: fix so non-NULL return can happen
• bitncmp: update comment to match code behaviour
• ares_set_servers_csv.3: make return type match code
• init_by_resolv_conf: ignore `fopen` errors to use default values
• Use "resolve" as synonym of "dns" in nsswitch.conf
• ares_win32_init: make LoadLibrary work when using UNICODE too
• dist: Distribute README.md
• configure: build silently by default
• ares_dup.3: remove mention of nonexistent function

Changes:

• Added ares_create_query(), to be used instead of ares_mkquery()
• ares_inet_ntop() and ares_inet_pton() are now recognized c-ares functions

Bug fixes:

• include the ares_parse_soa_reply.* files in the tarball
• read_udp_packets: bail out loop on bad sockets
• get_DNS_AdaptersAddresses: fix IPv6 parsing
• adig: perror() doesn't work for socket errors on windows
• ares_parse_aaaa_reply: fix memory leak
• setup_once.h: HP-UX issue workaround
• configure: several fixes
• config-dos.h: define strerror() to strerror_s_() for High-C
• config-dos.h: define HAVE_CLOSE_S for MSDOS/Watt-32
• ares_build.h.dist: enhance non-configure GCC ABI detection logic
• ares.h: stricter CARES_EXTERN linkage decorations logic
• ares_cancel(): cancel requests safely
• protocol parsing: check input data stricter
• library init: be recursive, reference count inits/cleanups
• ares_parse_txt_reply: return a ares_txt_reply node for each sub-string
• ares_set_servers_csv: fixed IPv6 address parsing
• build: fix build on msvc11

Fixed:

• include the ares_parse_soa_reply.* files in the tarball

Changed:

• Added ares_parse_soa_reply

Fixed:

• libcares.pc generation for static MingW* cross builds
• ares_dup: UDP and TCP port byte order in saved options

Changed:

• Added ares_parse_naptr_reply()

Fixed:

• handle CNAME-only in ares_parse_aaaa_reply()
• support multiple DNS servers on Android
• check for __ANDROID__ in addition to ANDROID macro
• port numbers: convert them to network order
• get_iphlpapi_dns_info: fix buffer overrun
• configure: make CURL_CHECK_DEF ignore leading whitespace
• segfault triggered in ares_init_options()
• ares_getnameinfo's memcpy did not copy enough bytes
• ares_destroy: fix segfault in ares_destroy_options()
• CHANGES: generate from script
• configure: fix symbol hiding usability check

Fixed:

• detection of semicolon comments in resolv.conf
• avoid using system's inet_net_pton affected by the WLB-2008080064 advisory
• replacement ares_inet_net_pton affected by the WLB-2008080064 advisory
• replacement ares_inet_ntop affected by potential out of bounds write
• added install target to Makefile.msvc
• only fall back to AF_INET searches when looking for AF_UNSPEC addresses
• fixed ares_parse_*_reply memory leaks
• Use correct sizeof in ares_getnameinfo()
• IPv6-on-windows: find DNS servers correctly
• man pages: docs for the c-ares utility programs
• getservbyport replacement for Win CE
• config_sortlist: (win32) missing else
• advance_tcp_send_queue: avoid NULL ptr dereference
• configure: fix a bashism
• ares_expand_name: Fix encoded length for indirect root

Changed:

• local-bind: Support binding to local interface/IPs, see ares_set_local_ip4, ares_set_local_ip6, ares_set_local_dev

Fixed:

• memory leak in ares_getnameinfo
• add missing break that caused get_ares_servers to fail
• ares_parse_a_reply: fix CNAME response parsing
• init_by_options: don't copy an empty sortlist
• Replaced uint32_t with unsigned int to fix broken builds on a couple of platforms
• Fix lookup with HOSTALIASES set
• adig: fix NAPTR parsing
• compiler warning cleanups

Fixed:

• builds on Android
• now includes all files necessary to build it (1.7.2 lacked a file)

Changed:

• Added ares_parse_mx_reply()

Fixed:

• ares_init: Last, not first instance of domain or search should win
• improve alternative definition of bool
• fix VS2010 compiler warnings

Changed:

• added IPv6 name servers support

Fixed:

• closing of sockets on Windows systems
• MSVC deprecated compiler options warnings
• ares_process_fd() didn't check broken connections

Changed:

• in6_addr is not used in ares.h anymore, but a private ares_in6_addr is instead declared and used
• ares_gethostbyname() now supports 'AF_UNSPEC' as a family for resolving either AF_INET6 or AF_INET
• a build-time configured ares_socklen_t is now used instead of socklen_t
• new ares_library_init() and ares_library_cleanup() functions
• new --enable-curldebug configure option
• ARES_ECANCELLED is now sent as reason for ares_cancel()
• added ares_parse_srv_reply()
• added ares_parse_txt_reply()
• added ares_free_data()
• new --enable-symbol-hiding configure option
• new Makefile.msvc for any MSVC compiler or MS Visual Studio version
• addrttl and addr6ttl structs renamed to ares_addrttl and ares_addr6ttl
• naming convention for libraries built with MSVC, see README.msvc

Fixed:

• ares_parse_*_reply() functions now return ARES_EBADRESP instead of ARES_EBADNAME if the name in the response failed to decode
• only expose/export symbols starting with 'ares_'
• fix \Device\TCP handle leaks triggered by buggy iphlpapi.dll
• init without internet gone no longer fails
• out of bounds memory overwrite triggered with malformed /etc/hosts file
• function prototypes in man pages out of sync with ares.h

Changed:

• Added support for the glibc "rotate" resolv.conf option (or ARES_OPT_ROTATE)
• Added ares_gethostbyname_file()
• Added ares_dup()
• Added ares_set_socket_callback()

Fixed:

• improved configure detection of several functions
• improved source code portability
• adig supports a regular numerical dotted IP address for the -s option
• handling of EINPROGRESS for UDP connects
• ares_parse_ptr_reply() would cause a buffer to shrink instead of expand if a reply contained 8 or more records
• buildconf works on OS X

• fix adig sample application compilation failure on some systems
• fix pkg-config reporting of private libraries needed for static linking
• fallback to gettimeofday when monotonic clock is unavailable at run-time
• ares_gethostbyname() fallback from AAA to A records with CNAME present
• allow --enable-largefile and --disable-largefile configurations
• configure process no longer needs nor checks size of curl_off_t
• library will now be built with _REENTRANT symbol defined if needed
• Improved configure detection of number of arguments for getservbyport_r
• Improved query-ID randomness
• Validate that DNS response address matches the request address
• fix acountry sample application compilation failure on some systems

• code refactoring in ares_gethostbyaddr
• improved checking of /dev/urandom in configure script
• new sample application, acountry
• improved MSVC6 dsp files
• adig sample application supports NAPTR records
• improved file seeding randomizer
• improved parsing of resolver configuration files
• updated configure script to remove autoconf 2.62 warnings
• use monotonic time source if available
• return all PTR-records when doing reverse lookups
• millisecond resolution support for the timeout option

• added the ares_llist.h header that was missing in the 1.5.0 release

• SONAME bump to a few API and ABI breaking changes: - ares_host_callback() - ares_nameinfo_callback() - ares_parse_a_reply() - ares_parse_aaaa_reply()
• two valgrind reports were silenced
• ares_save_options() fix
• do DNS retries even on TCP connections
• correctly clear sockets from the fd_set in several functions
• always wait on TCP events to detect connect closures
• new socket options: ARES_OPT_SOCK_SNDBUF and ARES_OPT_SOCK_RCVBUF
• made the query callbacks receive the number of timeouts that happened during the execution of a query
• don't skip a server if it's the only one
• segfault when generating a DNS "Transaction ID" under low memory conditions
• ares_strerror() segfault fix
• added copyright texts to a few places that were missing them

• fixed VS2005 compiler warnings due to time_t being 64bit
• introduced cryptographically secure transaction IDs
• added ares_save_options()
• added ares_destroy_options()
• added ares_process_fd()
• fixed undefined return value in init_by_resolv_conf() function for windows
• added ares_parse_ns_reply()
• fix failure to get the search sequence of /etc/hosts and DNS from /etc/nsswitch.conf, /etc/host.conf or /etc/svc.conf when /etc/resolv.conf did not exist
• when domains were sert in the options struct, and there were domain/search entries in /etc/resolv.conf, the domains of the options struct would be overridden
• removed a couple of potential zero size memory allocations
• fixed the line endings in areslib.dsp