From f818a69b3d70922511583302177666029bec1d26 Mon Sep 17 00:00:00 2001 From: Tobias Stoeckmann Date: Wed, 3 Jun 2020 21:42:25 +0200 Subject: [PATCH] libpkgconf: pkg: fix out ouf boundary access If a file with a matching "uninstalled" name exists but cannot be parsed, an invalid memory area is accessed. How to reproduce: $ touch poc-uninstalled.pc $ PKG_CONFIG_PATH=. pkgconf poc --- libpkgconf/pkg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libpkgconf/pkg.c b/libpkgconf/pkg.c index 214f544..d420938 100644 --- a/libpkgconf/pkg.c +++ b/libpkgconf/pkg.c @@ -539,7 +539,8 @@ pkgconf_pkg_try_specific_path(pkgconf_client_t *client, const char *path, const { PKGCONF_TRACE(client, "found (uninstalled): %s", uninst_locbuf); pkg = pkgconf_pkg_new_from_file(client, uninst_locbuf, f); - pkg->flags |= PKGCONF_PKG_PROPF_UNINSTALLED; + if (pkg != NULL) + pkg->flags |= PKGCONF_PKG_PROPF_UNINSTALLED; } else if ((f = fopen(locbuf, "r")) != NULL) {