Fix ancient buffer overflow on unterminated macro options

- Test for terminating ')' existence before copying, otherwise we'll
  end up walking over the edge of the world.
- Return address from doDefine() on error will likely differ after
  this, whether that actually affects anything remains to be seen...
This commit is contained in:
Panu Matilainen 2014-06-11 15:28:36 +03:00
parent 272033470b
commit eb62542695
1 changed files with 9 additions and 9 deletions

View File

@ -485,9 +485,15 @@ doDefine(MacroBuf mb, const char * se, size_t slen, int level, int expandbody)
oe = ne + 1; oe = ne + 1;
if (*s == '(') { if (*s == '(') {
s++; /* skip ( */ s++; /* skip ( */
o = oe; /* Options must be terminated with ')' */
COPYOPTS(oe, s, oc); if (strchr(s, ')')) {
s++; /* skip ) */ o = oe;
COPYOPTS(oe, s, oc);
s++; /* skip ) */
} else {
rpmlog(RPMLOG_ERR, _("Macro %%%s has unterminated opts\n"), n);
goto exit;
}
} }
/* Copy body, skipping over escaped newlines */ /* Copy body, skipping over escaped newlines */
@ -558,12 +564,6 @@ doDefine(MacroBuf mb, const char * se, size_t slen, int level, int expandbody)
goto exit; goto exit;
} }
/* Options must be terminated with ')' */
if (o && oc != ')') {
rpmlog(RPMLOG_ERR, _("Macro %%%s has unterminated opts\n"), n);
goto exit;
}
if ((be - b) < 1) { if ((be - b) < 1) {
rpmlog(RPMLOG_ERR, _("Macro %%%s has empty body\n"), n); rpmlog(RPMLOG_ERR, _("Macro %%%s has empty body\n"), n);
goto exit; goto exit;