Fix several read pass buffer bugs, and a memleak.

diff --git a/ChangeLog b/ChangeLog
index 90d39f0de9285d2b9d59b78c210fa7a5f2453aeb..49b68463607f15e37b79c3b4527c340485a16680 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Thu Aug 22 23:37:45 CDT 2002 Adam Heath <doogie@debian.org>
+
+  * lib/database.c, lib/parse.c, lib/parsehelp.c, main/main.c: Fix several
+    read pass buffer bugs, and a memleak.
+
 Thu Aug 22 23:25:23 CDT 2002 Adam Heath <doogie@debian.org>
 
   * lib/nfmalloc.c: Fix read past buffer in lib/nfmalloc.c.

diff --git a/debian/changelog b/debian/changelog
index f295e5a55a919e5cc1036e599940e72358088b7e..62aa267a2dbf5530a9aa22146b3fe92c21574b08 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -5,6 +5,7 @@ dpkg (1.10.5) unstable; urgency=low
   * Fix extraction of md5sum in dpkg-scanpackages.  Closes: #153769.
   * Handle directories better in md5sum.  Closes: #157453.
   * Fix read past buffer in lib/nfmalloc.c.  Closes: #157304.
+  * Fix several read pass buffer bugs, and a memleak.  Closes: #155362.
 
  -- Adam Heath <doogie@debian.org>  UNRELEASED
 

diff --git a/lib/database.c b/lib/database.c
index b809dbe4d004834c5dd611fd17634d916b57f5f4..90e4ede5dfc5eefcf30d64b6391de3736e0e0450 100644 (file)
--- a/lib/database.c
+++ b/lib/database.c
@@ -181,7 +181,7 @@ struct pkginfo *findpackage(const char *inname) {
   pointerp= bins + (hash(name) & (BINS-1));
   while (*pointerp && strcasecmp((*pointerp)->name,name))
     pointerp= &(*pointerp)->next;
-  if (*pointerp) return *pointerp;
+  if (*pointerp) { free(name); return *pointerp; }
 
   newpkg= nfmalloc(sizeof(struct pkginfo));
   blankpackage(newpkg);

diff --git a/lib/parse.c b/lib/parse.c
index 951d3242a18e4dd31794e93588202afa934452e0..7133d923773c1e5e763198a3e64f6c5b18364854 100644 (file)
--- a/lib/parse.c
+++ b/lib/parse.c
@@ -173,6 +173,7 @@ int parsedb(const char *filename, enum parsedbflags flags,
         if (c == '\n' || c == MSDOS_EOF_CHAR) {
           lno++;
           c= getc_mmap(dataptr);
+         if (EOF_mmap(dataptr, endptr)) break;
 /* Found double eol, or start of new field */
           if (EOF_mmap(dataptr, endptr) || c == '\n' || !isspace(c)) break;
           ungetc_mmap(c,dataptr, data);

diff --git a/lib/parsehelp.c b/lib/parsehelp.c
index d02b009eb692e5b6cd4077dc07a77052b4ff7afe..c7295024375bce749d5507c23baa884cd060059e 100644 (file)
--- a/lib/parsehelp.c
+++ b/lib/parsehelp.c
@@ -214,7 +214,7 @@ const char *parseversion(struct versionrevision *rversion, const char *string) {
   } else {
     rversion->epoch= 0;
   }
-  rversion->version= nfstrnsave(string,end-string+1);
+  rversion->version= nfstrnsave(string,end-string);
   hyphen= strrchr(rversion->version,'-');
   if (hyphen) *hyphen++= 0;
   rversion->revision= hyphen ? hyphen : "";

diff --git a/main/main.c b/main/main.c
index 407702b945f0bbda540e6b46a14d91607ad08207..8e8ef1225e1c5492d165e29b99b1c2f53f611974 100644 (file)
--- a/main/main.c
+++ b/main/main.c
@@ -433,7 +433,7 @@ void execbackend(const char *const *argv) {
   int i, argc = 1;
   const char *const *arg = argv;
   while(*arg != 0) { arg++; argc++; }
-  nargv= malloc(sizeof(char *) * argc + 2);
+  nargv= malloc(sizeof(char *) * (argc + 2));
 
   if (!nargv) ohshite(_("couldn't malloc in execbackend"));
   nargv[0]= strdup(cipaction->parg);