diff --git a/backport-Fix-a-possible-format-overflow-in-dump_genid.patch b/backport-Fix-a-possible-format-overflow-in-dump_genid.patch new file mode 100644 index 0000000000000000000000000000000000000000..27097aaf564ae37c6610a77ead334ad02743ee7b --- /dev/null +++ b/backport-Fix-a-possible-format-overflow-in-dump_genid.patch @@ -0,0 +1,58 @@ +From f31c6de1a7051d2d98efec2a56b92f6da0fef537 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= +Date: Wed, 10 Jul 2024 16:54:56 +0200 +Subject: [PATCH] Fix a possible format overflow in dump_genid() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +GCC 14 called with CFLAGS='-O2 -Wformat-overflow' complains: + + /tmp/libsolv/ext/testcase.c: In function ‘dump_genid’: + /tmp/libsolv/ext/testcase.c:1275:33: warning: ‘: genid ’ directive writing 8 bytes into a region of size between 3 and 12 [-Wformat-overflow=] + 1275 | sprintf(cntbuf, "genid %2d: genid ", cnt++); + | ^~~~~~~~ + /tmp/libsolv/ext/testcase.c:1275:7: note: ‘sprintf’ output between 17 and 26 bytes into a destination of size 20 + 1275 | sprintf(cntbuf, "genid %2d: genid ", cnt++); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + /tmp/libsolv/ext/testcase.c:1270:33: warning: ‘: genid ’ directive writing 8 bytes into a region of size between 3 and 12 [-Wformat-overflow=] + 1270 | sprintf(cntbuf, "genid %2d: genid ", cnt++); + | ^~~~~~~~ + /tmp/libsolv/ext/testcase.c:1270:7: note: ‘sprintf’ output between 17 and 26 bytes into a destination of size 20 + 1270 | sprintf(cntbuf, "genid %2d: genid ", cnt++); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +That's indeed a bug: sprintf() writes into a 20-byte array cntbuf. cnt +is int, 32-bit long integer on x86_64 Linux platform. dump_genid() +starts with cnt = 1 and increases. It can go up to 2147483647 decimal +value, then wrap to -2147483648 decimal value. That's up to 11 bytes +of the integer, plus 14 bytes of a static string, plus 1 byte of +a trailing '\0'. 26 bytes in total. + +While it's improbable that cnt would amount that long number in real +life, it's better to be prepared for the worst. Also a benefit is that +static analyzers will be be content. + +This patch increases cntbuf[] size to accomodate common 32-bit +ints. (Generic, albeit illegible, expression would be: + + cntbuf[((sizeof(cnt) * 8 - 1) * 3 / 10 + 1 + 1) + 14 + 1]; + +but I'm not sure that long expression is worth of it.) +--- + ext/testcase.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/ext/testcase.c b/ext/testcase.c +index d3533b9bf..1640ad7ad 100644 +--- a/ext/testcase.c ++++ b/ext/testcase.c +@@ -1256,7 +1256,7 @@ static int + dump_genid(Pool *pool, Strqueue *sq, Id id, int cnt) + { + struct oplist *op; +- char cntbuf[20]; ++ char cntbuf[26]; + const char *s; + + if (ISRELDEP(id)) diff --git a/backport-Fix-incomplete-headers.patch b/backport-Fix-incomplete-headers.patch new file mode 100644 index 0000000000000000000000000000000000000000..5a8fbad9dea96b981df660db7c6138fd0a2afbca --- /dev/null +++ b/backport-Fix-incomplete-headers.patch @@ -0,0 +1,31 @@ +From 9169e25bb2bab6af8cba0008b77a55de22833168 Mon Sep 17 00:00:00 2001 +From: AntoinePrv +Date: Wed, 3 May 2023 14:59:23 +0200 +Subject: [PATCH] Fix incomplete headers + +--- + src/rules.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/src/rules.h b/src/rules.h +index 92efe8a7c..895462a5c 100644 +--- a/src/rules.h ++++ b/src/rules.h +@@ -13,10 +13,17 @@ + #ifndef LIBSOLV_RULES_H + #define LIBSOLV_RULES_H + ++#include "pooltypes.h" ++ + #ifdef __cplusplus + extern "C" { + #endif + ++typedef struct s_Solvable Solvable; ++typedef struct s_Map Map; ++typedef struct s_Queue Queue; ++ ++ + /* ---------------------------------------------- + * Rule + * diff --git a/libsolv.spec b/libsolv.spec index cf993fb2e67aefce67717dc67b6a485e61051ecb..f88564cc66590c7bdd5cd24e17964b236356c672 100644 --- a/libsolv.spec +++ b/libsolv.spec @@ -15,7 +15,7 @@ Name: libsolv Version: 0.7.24 -Release: 3 +Release: 4 Summary: Package dependency solver License: BSD URL: https://github.com/openSUSE/libsolv @@ -28,6 +28,8 @@ Patch6004: backport-Fix-a-couple-small-static-analysis-findings-for-uninitializ Patch6005: backport-resolve-installed-remove-dead-code.patch Patch6006: backport-Move-special-updaters-handling-into-its-own-function.patch Patch6007: backport-Handle-installed-packages-in-three-passes.patch +Patch6008: backport-Fix-incomplete-headers.patch +Patch6009: backport-Fix-a-possible-format-overflow-in-dump_genid.patch BuildRequires: cmake gcc-c++ ninja-build pkgconfig(rpm) zlib-devel BuildRequires: libxml2-devel xz-devel bzip2-devel @@ -221,6 +223,10 @@ Python 3 version. %{_mandir}/man3/%{name}*.3* %changelog +* Tue Jul 23 2024 zhangxingrong - 0.7.24-4 +- Fix incomplete headers +- Fix a possible format overflow in dump_genid + * Fri Jul 5 2024 guojunding - 0.7.24-3 - Handle installed packages in three passes