[Rpm-maint] [rpm-software-management/rpm] Prevent buffer overruns in findPreambleTag() for language string (PR #4188)

[Panu Matilainen]

@pmatilai commented on this pull request.



> @@ -1177,14 +1179,17 @@ static int findPreambleTag(rpmSpec spec, PreambleRec * pr, const char ** macro,
     case 2:
 	if (*s == ':') {
 	    /* Type 1 is multilang, 2 is qualifiers with no defaults */
-	    strcpy(lang, (p->type == 1) ? RPMBUILD_DEFAULT_LANG : "");
+	    strlcpy(lang, (p->type == 1) ? RPMBUILD_DEFAULT_LANG : "", langsize);

Almost hit approve + merge, but then the `<string.h>` inclusion caught my eye at the last moment: why is that needed? 

`strlcpy()` is not in POSIX-1.2008 which is the rpm baseline, so we can't use that. But, rpm has its own implementation called `rstrlcpy()` which you can use instead, and for that you don't need any extra includes either.

Sorry for not catching this earlier.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/4188?email_source=notifications&email_token=ADLPZU5SOVKXUGAFHIUV3CD4XBQBVA5CNFSNUABKM5UWIORPF5TWS5BNNB2WEL2QOVWGYUTFOF2WK43UKJSXM2LFO4XTIMJVGI2DKMJWHA2KM4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOS6XA4S7OJSXM2LFO5PW433UNFTGSY3BORUW63TTL5RWY2LDNM#pullrequestreview-4152451684
You are receiving this because you are subscribed to this thread.

Message ID: <rpm-software-management/rpm/pull/4188/review/4152451684 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20260421/231c482a/attachment.htm>