Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
Bug 161091 - overflow in macro expansion if last character is a '%'
overflow in macro expansion if last character is a '%'
Product: Fedora
Classification: Fedora
Component: rpm (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Paul Nasrat
Mike McLean
Depends On:
  Show dependency treegraph
Reported: 2005-06-20 11:09 EDT by Nanar
Modified: 2007-11-30 17:11 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2005-07-13 05:53:38 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
check next character is not NULL (817 bytes, patch)
2005-06-20 11:11 EDT, Nanar
no flags Details | Diff

  None (edit)
Description Nanar 2005-06-20 11:09:16 EDT
From Bugzilla Helper:

Description of problem:
The macro expansion code skip '%' to find the macro name, but don't check if 
this one is the latest character of the string. It result the macro expansion 
continue after the end of the query. 

Version-Release number of selected component (if applicable):
rpm-4.4.1 (cvs included)

How reproducible:

Steps to Reproduce:
1. on command line: rpm --eval '%' or whatever ending by a '%' 
2. if nothing wrong appear, try to use some --define to change memory pointer 

Actual Results:  The result is unpredictible 

Expected Results:  '%' should return '%'. 

Additional info:

Of course, rpm can crash, depending of the pointer location.
Comment 1 Nanar 2005-06-20 11:11:46 EDT
Created attachment 115695 [details]
check next character is not NULL

This patch add a check of next character before skipping '%', is next one is
NULL, don't skip it.
Comment 2 Jeff Johnson 2005-07-13 05:53:38 EDT
CHecked into cvs, should be in rpm-4.4.2-0.8 when built. Thanks for the patch.

Note You need to log in before you can comment on or make changes to this bug.