diff options
| author |   Fabian Groffen <grobian@gentoo.org> | 2024-03-29 12:19:52 +0100 |
|---|---|---|
| committer | Fabian Groffen <grobian@gentoo.org> | 2024-03-29 12:19:52 +0100 |
| commit | cc4de0decf915ee76fcbf4420f15e68e6d10a17a (patch) | |
| tree | e3451e8eb9032cf1fdc040503b2dad67e2a769f0 | |
| parent | tests: Avoid leaking buf in copy_file/test.c (diff) | |
| download | portage-utils-cc4de0decf915ee76fcbf4420f15e68e6d10a17a.tar.gz portage-utils-cc4de0decf915ee76fcbf4420f15e68e6d10a17a.tar.bz2 portage-utils-cc4de0decf915ee76fcbf4420f15e68e6d10a17a.zip | |
qmanifest: avoid out of bounds access in append_list macro
Empty strings, or those being just whitespace were not handled
correctly. Thanks bstaletic in PR #19 for pointing this out. Avoid
running under the original string pointer and skip any checks for
strings that are too short to match anything in particular. This sweeps
an edgecase of just a single whitespace char under the carpet -- which
is just about fine, for it needs not to be handled for any legitimate
case.
Signed-off-by: Fabian Groffen <grobian@gentoo.org>
| -rw-r--r-- | qmanifest.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/qmanifest.c b/qmanifest.c index 2bb0f11..5246fc4 100644 --- a/qmanifest.c +++ b/qmanifest.c @@ -1421,13 +1421,15 @@ verify_manifest( #define append_list(STR) \ if (strncmp(STR, "TIMESTAMP ", 10) != 0 || strncmp(STR, "DIST ", 5) != 0) {\ char *endp = STR + strlen(STR) - 1;\ - while (isspace(*endp))\ + while (endp > STR && isspace(*endp))\ *endp-- = '\0';\ if (elemslen == elemssize) {\ elemssize += LISTSZ;\ elems = xrealloc(elems, elemssize * sizeof(elems[0]));\ }\ - if (strncmp(STR, "IGNORE ", 7) == 0) {\ + if (endp - STR < 4) {\ + /* avoid doing comparisons, none will match */\ + } else if (strncmp(STR, "IGNORE ", 7) == 0) {\ STR[5] = 'I';\ elems[elemslen] = xstrdup(STR + 5);\ elemslen++;\ |