forked from ariadne/pkgconf
5eb9cae009
This is the same issue which has been fixed in dependency code.
If a line contains a variable which is longer than PKGCONF_ITEM_SIZE,
then the varname buffer overflows.
The code itself still does not check if a closing } exists and
truncates variable names which are too long. Since these would
be functional changes and this commit is about a protection against
undefined behaviour on a language level, these changes are not
included.
Proof of concept:
$ echo "Description: poc" > poc.pc
$ echo "Version: 1" >> poc.pc
$ echo -n 'Name: ${'
$ dd if=/dev/zero bs=1 count=66535 | tr '\0' 'x' >> poc.pc
$ echo >> poc.pc
$ pkgconf poc.pc
On my Linux system, when compiled with gcc, the varname buffer overflows
directly into buf, which means that no crash can be notified.
It's easiest to figure out when adding strlen() and sizeof() output
as debug lines.
|
||
|---|---|---|
| .. | ||
| argvsplit.c | ||
| audit.c | ||
| bsdstubs.c | ||
| bsdstubs.h | ||
| cache.c | ||
| client.c | ||
| config.h.meson | ||
| dependency.c | ||
| fileio.c | ||
| fragment.c | ||
| iter.h | ||
| libpkgconf-api.h | ||
| libpkgconf.h | ||
| meson.build | ||
| parser.c | ||
| path.c | ||
| personality.c | ||
| pkg.c | ||
| queue.c | ||
| stdinc.h | ||
| tuple.c | ||
| win-dirent.h | ||