rpms/pappl
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix crash in write_log() due invalid buffer size

Browse Source 
I've encountered it when I was starting lprint service and it crashed on
this function - the crash itself appeared because pappl is now built
with _FORTIFY_SOURCE=3, which detects this invalid buffer size and crash
the application.

The problem was that higher pointer was subtracted from a lower to get
buffer size, so it ended up negative. The fix is from upstream, see the
link in SPEC file.
This commit is contained in:
Zdenek Dohnal 2023-04-13 07:27:40 +02:00
parent b09c8272d7
commit ce806a465d
2 changed files with 52 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
pappl-writelog.patch Normal file
View File

@ -0,0 +1,45 @@
diff --git a/pappl/log.c b/pappl/log.c
index 0559034..f740c3b 100644
--- a/pappl/log.c
+++ b/pappl/log.c
@@ -565,7 +565,7 @@ write_log(pappl_system_t *system, // I - System
case 'e' :
case 'f' :
case 'g' :
- snprintf(bufptr, (size_t)(bufptr - bufend + 1), tformat, va_arg(ap, double));
+ snprintf(bufptr, (size_t)(bufend - bufptr), tformat, va_arg(ap, double));
bufptr += strlen(bufptr);
break;
@@ -579,18 +579,18 @@ write_log(pappl_system_t *system, // I - System
case 'x' :
# ifdef HAVE_LONG_LONG
if (size == 'L')
- snprintf(bufptr, (size_t)(bufptr - bufend + 1), tformat, va_arg(ap, long long));
+ snprintf(bufptr, (size_t)(bufend - bufptr), tformat, va_arg(ap, long long));
else
# endif // HAVE_LONG_LONG
if (size == 'l')
- snprintf(bufptr, (size_t)(bufptr - bufend + 1), tformat, va_arg(ap, long));
+ snprintf(bufptr, (size_t)(bufend - bufptr), tformat, va_arg(ap, long));
else
- snprintf(bufptr, (size_t)(bufptr - bufend + 1), tformat, va_arg(ap, int));
+ snprintf(bufptr, (size_t)(bufend - bufptr), tformat, va_arg(ap, int));
bufptr += strlen(bufptr);
break;
case 'p' : // Log a pointer
- snprintf(bufptr, (size_t)(bufptr - bufend + 1), "%p", va_arg(ap, void *));
+ snprintf(bufptr, (size_t)(bufend - bufptr), "%p", va_arg(ap, void *));
bufptr += strlen(bufptr);
break;
@@ -651,7 +651,7 @@ write_log(pappl_system_t *system, // I - System
break;
default : // Something else we don't support
- papplCopyString(bufptr, tformat, (size_t)(bufptr - bufend + 1));
+ papplCopyString(bufptr, tformat, (size_t)(bufend - bufptr));
bufptr += strlen(bufptr);
break;
}

8
pappl.spec
View File

@ -10,11 +10,14 @@
Summary: Printer Application Framework (PAPPL)
Name: pappl
Version: 1.3.1
Release: 2%{?dist}
Release: 3%{?dist}
License: Apache-2.0
Source: https://github.com/michaelrsweet/pappl/releases/download/v%{version}/pappl-%{version}.tar.gz
Url: https://www.msweet.org/pappl
# https://github.com/michaelrsweet/pappl/pull/272
Patch0001: pappl-writelog.patch
BuildRequires: avahi-devel
BuildRequires: cups-devel
BuildRequires: gcc
@ -88,6 +91,9 @@ rm -f %{buildroot}/%{_libdir}/libpappl.a
%{_libdir}/pkgconfig/pappl.pc
%changelog
* Thu Apr 13 2023 Zdenek Dohnal <zdohnal@redhat.com> - 1.3.1-3
- fix crash due invalid buffer size in `write_log()`
* Thu Feb 16 2023 Richard Lescak <rlescak@redhat.com> - 1.3.1-2
- SPDX migration