77 lines
2.4 KiB
Diff
77 lines
2.4 KiB
Diff
From 0d38eb567a3f4b7c6c4898a502f7a505df588e88 Mon Sep 17 00:00:00 2001
|
|
From: Michael Schroeder <mls@suse.de>
|
|
Date: Tue, 19 May 2026 11:21:11 +0200
|
|
Subject: [PATCH 3/3] Add some guards to the tmpspace functions
|
|
|
|
I don't think this matters, but it's the right thing to do.
|
|
Also add pool_bin2hex to the size_t TODO list
|
|
---
|
|
src/pool.c | 14 ++++++++++++--
|
|
1 file changed, 12 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/src/pool.c b/src/pool.c
|
|
index 03f74bdb..f3b80e5e 100644
|
|
--- a/src/pool.c
|
|
+++ b/src/pool.c
|
|
@@ -38,6 +38,8 @@
|
|
#include "knownid.h"
|
|
#undef KNOWNID_INITIALIZE
|
|
|
|
+#define POOL_MAX_TMPSPACE_LEN 0x1000000
|
|
+
|
|
/* create pool */
|
|
Pool *
|
|
pool_create(void)
|
|
@@ -1760,6 +1762,8 @@ pool_alloctmpspace(Pool *pool, int len)
|
|
int n = pool->tmpspace.n;
|
|
if (!len)
|
|
return 0;
|
|
+ if (len >= POOL_MAX_TMPSPACE_LEN)
|
|
+ solv_ovfl("tmpspace size overflow");
|
|
if (len > pool->tmpspace.len[n])
|
|
{
|
|
pool->tmpspace.buf[n] = solv_realloc(pool->tmpspace.buf[n], len + 32);
|
|
@@ -1809,11 +1813,13 @@ pool_freetmpspace(Pool *pool, const char *space)
|
|
char *
|
|
pool_tmpjoin(Pool *pool, const char *str1, const char *str2, const char *str3)
|
|
{
|
|
- int l1, l2, l3;
|
|
+ size_t l1, l2, l3;
|
|
char *s, *str;
|
|
l1 = str1 ? strlen(str1) : 0;
|
|
l2 = str2 ? strlen(str2) : 0;
|
|
l3 = str3 ? strlen(str3) : 0;
|
|
+ if (l1 >= POOL_MAX_TMPSPACE_LEN || l2 >= POOL_MAX_TMPSPACE_LEN || l3 >= POOL_MAX_TMPSPACE_LEN)
|
|
+ solv_ovfl("tmpspace size overflow");
|
|
s = str = pool_alloctmpspace(pool, l1 + l2 + l3 + 1);
|
|
if (l1)
|
|
{
|
|
@@ -1837,12 +1843,14 @@ pool_tmpjoin(Pool *pool, const char *str1, const char *str2, const char *str3)
|
|
char *
|
|
pool_tmpappend(Pool *pool, const char *str1, const char *str2, const char *str3)
|
|
{
|
|
- int l1, l2, l3;
|
|
+ size_t l1, l2, l3;
|
|
char *s, *str;
|
|
|
|
l1 = str1 ? strlen(str1) : 0;
|
|
l2 = str2 ? strlen(str2) : 0;
|
|
l3 = str3 ? strlen(str3) : 0;
|
|
+ if (l1 >= POOL_MAX_TMPSPACE_LEN || l2 >= POOL_MAX_TMPSPACE_LEN || l3 >= POOL_MAX_TMPSPACE_LEN)
|
|
+ solv_ovfl("tmpspace size overflow");
|
|
str = pool_alloctmpspace_free(pool, str1, l1 + l2 + l3 + 1);
|
|
if (str)
|
|
str1 = str;
|
|
@@ -1875,6 +1883,8 @@ pool_bin2hex(Pool *pool, const unsigned char *buf, int len)
|
|
char *s;
|
|
if (!len)
|
|
return "";
|
|
+ if (len >= POOL_MAX_TMPSPACE_LEN / 2)
|
|
+ solv_ovfl("pool_bin2hex size overflow");
|
|
s = pool_alloctmpspace(pool, 2 * len + 1);
|
|
solv_bin2hex(buf, len, s);
|
|
return s;
|
|
--
|
|
2.55.0
|
|
|