Bug 161091

Summary: overflow in macro expansion if last character is a '%'
Product: [Fedora] Fedora Reporter: Nanar <olivier.thauvin>
Component: rpmAssignee: Paul Nasrat <nobody+pnasrat>
Status: CLOSED UPSTREAM QA Contact: Mike McLean <mikem>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: n3npq
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2005-07-13 09:53:38 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
check next character is not NULL none

Description Nanar 2005-06-20 15:09:16 UTC 
From Bugzilla Helper:
User-Agent: 

Description of problem:
The macro expansion code skip '%' to find the macro name, but don't check if 
this one is the latest character of the string. It result the macro expansion 
continue after the end of the query. 

Version-Release number of selected component (if applicable):
rpm-4.4.1 (cvs included)

How reproducible:
Always

Steps to Reproduce:
1. on command line: rpm --eval '%' or whatever ending by a '%' 
2. if nothing wrong appear, try to use some --define to change memory pointer 
 
   

Actual Results:  The result is unpredictible 

Expected Results:  '%' should return '%'. 

Additional info:

Of course, rpm can crash, depending of the pointer location.
Comment 1 Nanar 2005-06-20 15:11:46 UTC 
Created attachment 115695 [details]
check next character is not NULL

This patch add a check of next character before skipping '%', is next one is
NULL, don't skip it.
Comment 2 Jeff Johnson 2005-07-13 09:53:38 UTC 
CHecked into cvs, should be in rpm-4.4.2-0.8 when built. Thanks for the patch.