Bug 161091 - overflow in macro expansion if last character is a '%'
Summary: overflow in macro expansion if last character is a '%'
Alias: None
Product: Fedora
Classification: Fedora
Component: rpm
Version: rawhide
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Paul Nasrat
QA Contact: Mike McLean
Depends On:
TreeView+ depends on / blocked
Reported: 2005-06-20 15:09 UTC by Nanar
Modified: 2007-11-30 22:11 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2005-07-13 09:53:38 UTC
Type: ---

Attachments (Terms of Use)
check next character is not NULL (817 bytes, patch)
2005-06-20 15:11 UTC, Nanar
no flags Details | Diff

Description Nanar 2005-06-20 15:09:16 UTC
From Bugzilla Helper:

Description of problem:
The macro expansion code skip '%' to find the macro name, but don't check if 
this one is the latest character of the string. It result the macro expansion 
continue after the end of the query. 

Version-Release number of selected component (if applicable):
rpm-4.4.1 (cvs included)

How reproducible:

Steps to Reproduce:
1. on command line: rpm --eval '%' or whatever ending by a '%' 
2. if nothing wrong appear, try to use some --define to change memory pointer 

Actual Results:  The result is unpredictible 

Expected Results:  '%' should return '%'. 

Additional info:

Of course, rpm can crash, depending of the pointer location.

Comment 1 Nanar 2005-06-20 15:11:46 UTC
Created attachment 115695 [details]
check next character is not NULL

This patch add a check of next character before skipping '%', is next one is
NULL, don't skip it.

Comment 2 Jeff Johnson 2005-07-13 09:53:38 UTC
CHecked into cvs, should be in rpm-4.4.2-0.8 when built. Thanks for the patch.

Note You need to log in before you can comment on or make changes to this bug.