- resolves: #876108

fixed size_t underflow in pipeline_readline() function

libpipeline-1.2.2-peek-offset.patch

@@ -0,0 +1,19 @@
+diff -upr libpipeline-1.2.2.orig/lib/pipeline.c libpipeline-1.2.2/lib/pipeline.c
+--- libpipeline-1.2.2.orig/lib/pipeline.c	2012-03-04 18:43:07.000000000 +0100
++++ libpipeline-1.2.2/lib/pipeline.c	2012-11-30 14:46:14.395724863 +0100
+@@ -2168,8 +2168,13 @@ const char *pipeline_readline (pipeline
+ {
+ 	size_t buflen;
+ 	const char *buffer = get_line (p, &buflen);
+-	if (buffer)
+-		p->peek_offset -= buflen;
++	if (buffer) {
++		if (p->peek_offset > buflen) {
++			p->peek_offset -= buflen;
++		} else {
++			p->peek_offset = 0;
++		}
++	}
+ 	return buffer;
+ }
+ 

libpipeline.spec

@@ -3,12 +3,15 @@
 Summary: A pipeline manipulation library
 Name: libpipeline
 Version: 1.2.2
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: GPLv3+
 Group: Development/Libraries
 URL: http://libpipeline.nongnu.org/
 Source: http://download.savannah.gnu.org/releases/libpipeline/libpipeline-%{version}.tar.gz
 
+# resolves: #876108
+Patch: libpipeline-1.2.2-peek-offset.patch
+
 BuildRequires: libtool, check-devel
 
 # FPC exception for gnulib - copylib - https://fedorahosted.org/fpc/ticket/174
@@ -17,7 +20,7 @@ Provides: bundled(gnulib) = %{gnulib_ver}
 %description
 libpipeline is a C library for setting up and running pipelines of
 processes, without needing to involve shell command-line parsing which is
-often error-prone and insecure.  This alleviates programmers of the need to
+often error-prone and insecure. This alleviates programmers of the need to
 laboriously construct pipelines using lower-level primitives such as fork(2)
 and execve(2).
 
@@ -33,6 +36,7 @@ to develop programs that use libpipeline library.
 
 %prep
 %setup -q
+%patch -p1 -b .peek-offset
 
 %build
 %{configure}
@@ -60,6 +64,10 @@ rm $RPM_BUILD_ROOT/%{_libdir}/libpipeline.la
 %{_mandir}/man3/*
 
 %changelog
+* Fri Nov 30 2012 Peter Schiffer <pschiffe@redhat.com> - 1.2.2-2
+- resolves: #876108
+  fixed size_t underflow in pipeline_readline() function
+
 * Thu Oct 18 2012 Peter Schiffer <pschiffe@redhat.com> - 1.2.2-1
 - updated to 1.2.2