[Rpm-maint] [rpm-software-management/rpm] Prevent buffer overruns in findPreambleTag() for language string (PR #4188)

[Dave Cantrell]

This is technically possible and there is a reproducer for it, but I would not consider this a critical problem.  If you have a really long language identifier string in a preamble tag and it's larger than BUFSIZ on the platform, you get a SIGSEGV.  Not a surprise.

In spec files you can have stuff like this in the preamble:

    Summary: Here is a short summary
    Summary(de): Hier ist eine kurze Zusammenfassung
    Summary(eo): Jen mallonga resumo
    Summary(Elvish): Sí na- a estent summarui
    Summary(ga_ie): Is coimriú ghearr é seo
    Summary(Klingon): naDev 'oH ngaj summary

And findPreambleTag() is eventually called to pick up those language identifiers in parens.  Usually the identifiers are two characters, but sometimes they are three or four.  The parser in the library scans a character at a time until it hits the closing paren and just stuffs it all in the 'lang' buffer.  The problem is that buffer is BUFSIZ and there is no bounds checking to see if the string in the spec file in parens is larger than what BUFSIZ can hold.  So it is technically possible to provide a spec file with a completely useless huge string as a language identifier that then crashes the spec file parser.

This patch adds some bounds checking to that reading loop to prevent this incredibly rare yet technically possible issue.  I don't bother growing the buffer if we're still reading characters because honestly if we have more than BUFSIZ in parens, we've got a garbage spec file.

The patch does ensure the unused space in BUFSIZ is NULL and that the lang buffer is NULL terminated so it's moderately useful in later parts of the code.
You can view, comment on, or merge this pull request online at:

  https://github.com/rpm-software-management/rpm/pull/4188?email_source=notifications&email_token=ADLPZU47AIXL3AVPBPY3XND4WZ3EPA5CNFSNUABEM5UWIORPF5TWS5BNNB2WEL2QOVWGYUTFOF2WK43UF4ZTKNJXHE4TSMRTGWTHEZLBONXW5KTTOVRHGY3SNFRGKZFFMV3GK3TUVVYHEX3POBSW4X3DNRUWG2Y

-- Commit Summary --

  * Prevent buffer overruns in findPreambleTag() for language string

-- File Changes --

    M build/parsePreamble.cc (13)

-- Patch Links --

https://github.com/rpm-software-management/rpm/pull/4188.patch?email_source=notifications&email_token=ADLPZU4MJKI45UIDSMVWWIT4WZ3EPA5CNFSNUABEM5UWIORPF5TWS5BNNB2WEL2QOVWGYUTFOF2WK43UF4ZTKNJXHE4TSMRTGWTHEZLBONXW5KTTOVRHGY3SNFRGKZFFMV3GK3TUVZYHEX3QMF2GG2C7MNWGSY3Lhttps://github.com/rpm-software-management/rpm/pull/4188.diff?email_source=notifications&email_token=ADLPZU6PIJ6EVXOGUOYH6PD4WZ3EPA5CNFSNUABEM5UWIORPF5TWS5BNNB2WEL2QOVWGYUTFOF2WK43UF4ZTKNJXHE4TSMRTGWTHEZLBONXW5KTTOVRHGY3SNFRGKZFFMV3GK3TUVVYHEX3ENFTGMX3DNRUWG2Y
-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/4188
You are receiving this because you are subscribed to this thread.

Message ID: <rpm-software-management/rpm/pull/4188 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20260420/744fd785/attachment.htm>