summaryrefslogtreecommitdiff
path: root/apt-pkg
diff options
context:
space:
mode:
authorJulian Andres Klode <jak@debian.org>2016-06-28 10:24:11 +0200
committerJulian Andres Klode <jak@debian.org>2016-06-28 22:15:50 +0200
commitb6e9756ca03ec887ef1d0bc8e38f63c29db7a365 (patch)
treef394c5fc42417b44784d595e3e5b3be1b007b250 /apt-pkg
parentb4f91d4d150a0d9bcc77563abbc03d28da2ff4e3 (diff)
Fix buffer overflow in debListParser::VersionHash()
If a package file is formatted in a way that that no space follows a deprecated "<", we would reformat it to "<=" and increase the length of the output by 1, which can break. Under normal circumstances with "<=" this should not be an issue. Closes: #828812
Diffstat (limited to 'apt-pkg')
-rw-r--r--apt-pkg/deb/deblistparser.cc8
1 files changed, 6 insertions, 2 deletions
diff --git a/apt-pkg/deb/deblistparser.cc b/apt-pkg/deb/deblistparser.cc
index ed5484ad9..e24ced271 100644
--- a/apt-pkg/deb/deblistparser.cc
+++ b/apt-pkg/deb/deblistparser.cc
@@ -357,8 +357,12 @@ unsigned short debListParser::VersionHash()
continue;
*J++ = tolower_ascii(*Start);
- if ((*Start == '<' || *Start == '>') && Start[1] != *Start && Start[1] != '=')
- *J++ = '=';
+ /* Normalize <= to < and >= to >. This is the wrong way around, but
+ * more efficient that the right way. And since we're only hashing
+ * it does not matter which way we normalize. */
+ if ((*Start == '<' || *Start == '>') && Start[1] == '=') {
+ Start++;
+ }
}
Result = AddCRC16(Result,S,J - S);