rpm/rpm-4.13.0-memory-error.patch

30 lines
911 B
Diff
Raw Normal View History

From 54f24ec5486bdacde9419466a2c27defaddf508e Mon Sep 17 00:00:00 2001
From: Lubos Kardos <lkardos@redhat.com>
Date: Mon, 21 Sep 2015 11:02:45 +0200
Subject: [PATCH] Fix reading a memory right after the end of an allocated
area.
The problem evinced itself when somebody tried to use the macro
expansion on the string "%!". The problem was revealed by compiling
with "--fsanitize=memory" (rhbz:#1260248).
---
rpmio/macro.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/rpmio/macro.c b/rpmio/macro.c
index 46e6b87..4b3c41b 100644
--- a/rpmio/macro.c
+++ b/rpmio/macro.c
@@ -993,7 +993,7 @@ expandMacro(MacroBuf mb, const char *src, size_t slen)
chkexist = 0;
switch ((c = *s)) {
default: /* %name substitution */
- while (strchr("!?", *s) != NULL) {
+ while (*s != '\0' && strchr("!?", *s) != NULL) {
switch(*s++) {
case '!':
negate = ((negate + 1) % 2);
--
1.9.3