rpms/annobin
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Annocheck: Fix bug checking the path safety of the --debug-dir option.

Browse Source
This commit is contained in:
Nick Clifton 2026-08-11 11:12:29 +01:00
parent 86892c79eb
commit fa9fe9aaf5
2 changed files with 21 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
annobin-debug-dir-path-check.patch Normal file
View File

@ -0,0 +1,17 @@
diff -rup orig/annocheck/annocheck.c annobin-13.28/annocheck/annocheck.c
--- orig/annocheck/annocheck.c 2026-08-11 10:59:33.981880653 +0100
+++ annobin-13.28/annocheck/annocheck.c 2026-08-11 11:00:46.525312028 +0100
@@ -730,10 +730,11 @@ extract_debug_rpm_files (void)
using_tmpdir = true;
char * cwd = getcwd (NULL, 0);
- const char * tmp = concat ("--debug-dir=", cwd, "/", tmp_debug_dir, NULL);
+#define DEBUG_DIR_OPTION "--debug-dir="
+ const char * tmp = concat (DEBUG_DIR_OPTION, cwd, "/", tmp_debug_dir, NULL);
/* This should never happen, but let's be paranoid. */
- if (! is_safe_path (tmp))
+ if (! is_safe_path (tmp + strlen (DEBUG_DIR_OPTION)))
{
afinfo (ERROR, tmp, "Path to temporary debug dir contains suspicious characters");
free ((void *) tmp_debug_dir);

8
annobin.spec
View File

@ -1,5 +1,5 @@
Name: annobin
Name: annobin
Summary: Annotate and examine compiled binary files
Version: 13.28
Release: 1%{?dist}
@ -72,8 +72,7 @@ Source: https://nickc.fedorapeople.org/%{annobin_sources}
%global annobin_source_dir %{_usrsrc}/annobin
# Insert patches here, if needed. Eg:
# Patch01: annobin-plugin-default-string-notes.patch
# Patch01: annobin-gcc-plugin-input-filename.patch
Patch01: annobin-debug-dir-path-check.patch
#---------------------------------------------------------------------------------
@ -538,6 +537,7 @@ make check
%changelog
* Thu Jul 23 2026 Nick Clifton <nickc@redhat.com> - 13.28-1
- Annocheck: Fix bug checking the path safety of the --debug-dir option.
- Annocheck: Add more exceptions for gcc components. (RHEL-213510)
- Annocheck: Fix seg-fault in code checking for gcc components.
- Annocheck: Allow ~ in filenames.
@ -1231,7 +1231,7 @@ make check
* Fri Dec 17 2021 Nick Clifton <nickc@redhat.com> - 10.39-1
- Annocheck: Add /usr/lib/ld-linux-aarch64.so.1 to the list of known glibc binaries. (#2033255)
- Doc: Note that ENDBR is only needed as the landing pad for indirect branches/calls. (#28705)
- Spec File: Store full gcc version release string in plugin info file. (#2030671)
- Spec File: Store full gcc version release string in plugin info file. (#2030671)
* Tue Dec 14 2021 Nick Clifton <nickc@redhat.com> - 10.38-1
- Annocheck: Add special case for x86_64 RHEL-7 gaps. (#2031133)