Bug 161091 - overflow in macro expansion if last character is a '%'
Summary: overflow in macro expansion if last character is a '%'
Keywords:
Status: CLOSED UPSTREAM
Alias: None
Product: Fedora
Classification: Fedora
Component: rpm
Version: rawhide
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Paul Nasrat
QA Contact: Mike McLean
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2005-06-20 15:09 UTC by Nanar
Modified: 2007-11-30 22:11 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2005-07-13 09:53:38 UTC
Type: ---


Attachments (Terms of Use)
check next character is not NULL (817 bytes, patch)
2005-06-20 15:11 UTC, Nanar
no flags Details | Diff

Description Nanar 2005-06-20 15:09:16 UTC
From Bugzilla Helper:
User-Agent: 

Description of problem:
The macro expansion code skip '%' to find the macro name, but don't check if 
this one is the latest character of the string. It result the macro expansion 
continue after the end of the query. 

Version-Release number of selected component (if applicable):
rpm-4.4.1 (cvs included)

How reproducible:
Always

Steps to Reproduce:
1. on command line: rpm --eval '%' or whatever ending by a '%' 
2. if nothing wrong appear, try to use some --define to change memory pointer 
 
   

Actual Results:  The result is unpredictible 

Expected Results:  '%' should return '%'. 

Additional info:

Of course, rpm can crash, depending of the pointer location.

Comment 1 Nanar 2005-06-20 15:11:46 UTC
Created attachment 115695 [details]
check next character is not NULL

This patch add a check of next character before skipping '%', is next one is
NULL, don't skip it.

Comment 2 Jeff Johnson 2005-07-13 09:53:38 UTC
CHecked into cvs, should be in rpm-4.4.2-0.8 when built. Thanks for the patch.


Note You need to log in before you can comment on or make changes to this bug.