From 937f9bc67b905851c78719d8397926eaa97b174a Mon Sep 17 00:00:00 2001

From: Richard Phibel <richardphibel@meta.com>

Date: Mon, 22 May 2023 05:16:51 +0200

Subject: [PATCH] Fix stack overflow

Creation of array struct digestoffset offsets[rpmfiFC(fi)] caused a

stack overflow because the total size is greater than 8M which is the

stack size limit on Linux. To fix the issue, the array is allocated on

the heap.

I used AddressSanitizer to find the root cause of the issue. It found a

number of memory leaks so I fixed them as well.

---

 rpm2extents.c | 15 +++++++++++----

 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/rpm2extents.c b/rpm2extents.c

index c2a373914..0ee8666fa 100644

--- a/rpm2extents.c

+++ b/rpm2extents.c

@@ -226,6 +226,7 @@ exit:

     if(msg) {

 	free(msg);

     }

+    rpmtsFree(ts);

     return rc;

 }

@@ -243,6 +244,7 @@ static void sanitizeSignatureHeader(Header * sigh)

 	*sigh = headerLink(nh);

 	headerFree(nh);

     }

+    rpmtdFreeData(&td);

 }

 static rpmRC process_package(FD_t fdi, FD_t digestori, FD_t validationi)

@@ -281,6 +283,8 @@ static rpmRC process_package(FD_t fdi, FD_t digestori, FD_t validationi)

     rpmfiles files = NULL;

     rpmfi fi = NULL;

     char *msg = NULL;

+    struct digestoffset *offsets = NULL;

+    digestSet ds = NULL;

     fdo = fdDup(STDOUT_FILENO);

@@ -357,10 +361,8 @@ static rpmRC process_package(FD_t fdi, FD_t digestori, FD_t validationi)

 	 * now?)

 	 */

 	diglen = (uint32_t) rpmDigestLength(rpmfiDigestAlgo(fi));

-	digestSet ds =

-	    digestSetCreate(rpmfiFC(fi), digestSetHash, digestSetCmp,

-			    NULL);

-	struct digestoffset offsets[rpmfiFC(fi)];

+	ds = digestSetCreate(rpmfiFC(fi), digestSetHash, digestSetCmp, NULL);

+	offsets = xcalloc(rpmfiFC(fi), sizeof(*offsets));

 	pos = RPMLEAD_SIZE + headerSizeof(sigh, HEADER_MAGIC_YES);

 	/* main headers are aligned to 8 byte boundry */

@@ -494,6 +496,10 @@ static rpmRC process_package(FD_t fdi, FD_t digestori, FD_t validationi)

     rpmfilesFree(files);

     rpmfiFree(fi);

     headerFree(h);

+    headerFree(sigh);

+    free(offsets);

+    Fclose(fdo);

+    digestSetFree(ds);

     return rc;

 }

@@ -693,6 +699,7 @@ int main(int argc, char *argv[]) {

     FD_t fdi = fdDup(STDIN_FILENO);

     rc = teeRpm(fdi, algos, nb_algos);

+    Fclose(fdi);

     if (rc != RPMRC_OK) {

 	/* translate rpmRC into generic failure return code. */

 	return EXIT_FAILURE;

-- 

2.40.1