From fa9fe9aaf570f36a0bb7cb22b5a63a49e317a8b3 Mon Sep 17 00:00:00 2001 From: Nick Clifton Date: Tue, 11 Aug 2026 11:12:29 +0100 Subject: [PATCH] Annocheck: Fix bug checking the path safety of the --debug-dir option. --- annobin-debug-dir-path-check.patch | 17 +++++++++++++++++ annobin.spec | 8 ++++---- 2 files changed, 21 insertions(+), 4 deletions(-) create mode 100644 annobin-debug-dir-path-check.patch diff --git a/annobin-debug-dir-path-check.patch b/annobin-debug-dir-path-check.patch new file mode 100644 index 0000000..5c9baef --- /dev/null +++ b/annobin-debug-dir-path-check.patch @@ -0,0 +1,17 @@ +diff -rup orig/annocheck/annocheck.c annobin-13.28/annocheck/annocheck.c +--- orig/annocheck/annocheck.c 2026-08-11 10:59:33.981880653 +0100 ++++ annobin-13.28/annocheck/annocheck.c 2026-08-11 11:00:46.525312028 +0100 +@@ -730,10 +730,11 @@ extract_debug_rpm_files (void) + using_tmpdir = true; + + char * cwd = getcwd (NULL, 0); +- const char * tmp = concat ("--debug-dir=", cwd, "/", tmp_debug_dir, NULL); ++#define DEBUG_DIR_OPTION "--debug-dir=" ++ const char * tmp = concat (DEBUG_DIR_OPTION, cwd, "/", tmp_debug_dir, NULL); + + /* This should never happen, but let's be paranoid. */ +- if (! is_safe_path (tmp)) ++ if (! is_safe_path (tmp + strlen (DEBUG_DIR_OPTION))) + { + afinfo (ERROR, tmp, "Path to temporary debug dir contains suspicious characters"); + free ((void *) tmp_debug_dir); diff --git a/annobin.spec b/annobin.spec index ad70f24..95e0ece 100644 --- a/annobin.spec +++ b/annobin.spec @@ -1,5 +1,5 @@ -Name: annobin +Name: annobin Summary: Annotate and examine compiled binary files Version: 13.28 Release: 1%{?dist} @@ -72,8 +72,7 @@ Source: https://nickc.fedorapeople.org/%{annobin_sources} %global annobin_source_dir %{_usrsrc}/annobin # Insert patches here, if needed. Eg: -# Patch01: annobin-plugin-default-string-notes.patch -# Patch01: annobin-gcc-plugin-input-filename.patch +Patch01: annobin-debug-dir-path-check.patch #--------------------------------------------------------------------------------- @@ -538,6 +537,7 @@ make check %changelog * Thu Jul 23 2026 Nick Clifton - 13.28-1 +- Annocheck: Fix bug checking the path safety of the --debug-dir option. - Annocheck: Add more exceptions for gcc components. (RHEL-213510) - Annocheck: Fix seg-fault in code checking for gcc components. - Annocheck: Allow ~ in filenames. @@ -1231,7 +1231,7 @@ make check * Fri Dec 17 2021 Nick Clifton - 10.39-1 - Annocheck: Add /usr/lib/ld-linux-aarch64.so.1 to the list of known glibc binaries. (#2033255) - Doc: Note that ENDBR is only needed as the landing pad for indirect branches/calls. (#28705) -- Spec File: Store full gcc version release string in plugin info file. (#2030671) +- Spec File: Store full gcc version release string in plugin info file. (#2030671) * Tue Dec 14 2021 Nick Clifton - 10.38-1 - Annocheck: Add special case for x86_64 RHEL-7 gaps. (#2031133)