rpms/pcre
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix a potenial buffer overflow in formatting a pcregrep error message

Browse Source
This commit is contained in:
Petr Písař 2017-02-14 17:13:28 +01:00
parent 2ee90d0464
commit 09d899911e
2 changed files with 56 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
pcre-8.40-Silent-a-GCC-7-warning-about-too-small-buffer-for-pr.patch Normal file
View File

@ -0,0 +1,50 @@
From 875a7d84d6cc77431db27eeb140d9e94e4584e31 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Tue, 14 Feb 2017 17:00:44 +0100
Subject: [PATCH] Silent a GCC 7 warning about too small buffer for printing an
integer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
GCC 7 reports this warning:
pcregrep.c:3194:68: warning: '%d' directive writing between 1 and 10 bytes into
a region of size 8 [-Wformat-overflow=]
if (patterns->next == NULL) s[0] = 0; else sprintf(s, " number %d", j);
^~
pcregrep.c:3194:59: note: directive argument in the range [1, 2147483647]
if (patterns->next == NULL) s[0] = 0; else sprintf(s, " number %d", j);
^~~~~~~~~~~~
because the buffer s[] has only 16 characters. With 32-bit integers,
one needs up to 19 bytes to represent the sprintf() text.
This patch fixes it by avoiding the buffer at all.
Signed-off-by: Petr Písař <ppisar@redhat.com>
---
pcregrep.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/pcregrep.c b/pcregrep.c
index 3cd70ee..87a3c2e 100644
--- a/pcregrep.c
+++ b/pcregrep.c
@@ -3190,9 +3190,11 @@ for (j = 1, cp = patterns; cp != NULL; j++, cp = cp->next)
cp->hint = pcre_study(cp->compiled, study_options, &error);
if (error != NULL)
{
- char s[16];
- if (patterns->next == NULL) s[0] = 0; else sprintf(s, " number %d", j);
- fprintf(stderr, "pcregrep: Error while studying regex%s: %s\n", s, error);
+ if (patterns->next == NULL)
+ fprintf(stderr, "pcregrep: Error while studying regex: %s\n", error);
+ else
+ fprintf(stderr, "pcregrep: Error while studying regex number %d: %s\n",
+ j, error);
goto EXIT2;
}
#ifdef SUPPORT_PCREGREP_JIT
--
2.7.4

6
pcre.spec
View File

@ -40,6 +40,9 @@ Patch2: pcre-8.40-Correct-fix-for-pcre2grep-multiline-with-only-matchi.patch
# Fix a crash in JIT compilation, upstream bug #2035,
# in upstream after 8.40
Patch3: pcre-8.40-Fix-a-missing-else-in-the-JIT-compiler-reported-by-i.patch
# Fix a potenial buffer overflow in formatting a pcregrep error message,
# upstream bug #2037
Patch4: pcre-8.40-Silent-a-GCC-7-warning-about-too-small-buffer-for-pr.patch
BuildRequires: readline-devel
BuildRequires: autoconf
BuildRequires: automake
@ -131,6 +134,7 @@ Utilities demonstrating PCRE capabilities like pcregrep or pcretest.
%patch1 -p1
%patch2 -p1
%patch3 -p1
%patch4 -p1
# Because of rpath patch
libtoolize --copy --force
autoreconf -vif
@ -230,6 +234,8 @@ make %{?_smp_mflags} check VERBOSE=yes
* Tue Feb 14 2017 Petr Pisar <ppisar@redhat.com> - 8.40-2
- Fix pcre2grep multi-line matching --only-matching option (upstream bug #1848)
- Fix a crash in JIT compilation (upstream bug #2035)
- Fix a potenial buffer overflow in formatting a pcregrep error message
(upstream bug #2037)
* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 8.40-1.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild