Use rasprintf() to prevent overflows and remove BUFSIZ buffer limit.

diff --git a/build/expression.c b/build/expression.c
index d789b16..8ddfab2 100644 (file)
--- a/build/expression.c
+++ b/build/expression.c
@@ -715,9 +715,7 @@ char * parseExpressionString(rpmSpec spec, const char *expr)
 
   switch (v->type) {
   case VALUE_TYPE_INTEGER: {
-    char buf[128];
-    sprintf(buf, "%d", v->data.i);
-    result = xstrdup(buf);
+    rasprintf(&result, "%d", v->data.i);
   } break;
   case VALUE_TYPE_STRING:
     result = xstrdup(v->data.s);

diff --git a/build/pack.c b/build/pack.c
index b07679b..78c83e7 100644 (file)
--- a/build/pack.c
+++ b/build/pack.c
@@ -28,12 +28,10 @@ static inline int genSourceRpmName(rpmSpec spec)
 {
     if (spec->sourceRpmName == NULL) {
        const char *name, *version, *release;
-       char fileName[BUFSIZ];
 
        (void) headerNVR(spec->packages->header, &name, &version, &release);
-       sprintf(fileName, "%s-%s-%s.%ssrc.rpm", name, version, release,
+       rasprintf(&spec->sourceRpmName, "%s-%s-%s.%ssrc.rpm", name, version, release,
            spec->noSource ? "no" : "");
-       spec->sourceRpmName = xstrdup(fileName);
     }
 
     return 0;

diff --git a/build/spec.c b/build/spec.c
index 30ae4ce..9c58332 100644 (file)
--- a/build/spec.c
+++ b/build/spec.c
@@ -251,11 +251,10 @@ int addSource(rpmSpec spec, Package pkg, const char *field, rpmTag tag)
     int flag = 0;
     const char *name = NULL;
     char *nump;
-    const char *fieldp = NULL;
-    char buf[BUFSIZ];
+    char *fieldp = NULL;
+    char *buf = NULL;
     int num = 0;
 
-    buf[0] = '\0';
     switch ((rpm_tag_t) tag) {
       case RPMTAG_SOURCE:
        flag = RPMBUILD_ISSOURCE;
@@ -279,24 +278,28 @@ int addSource(rpmSpec spec, Package pkg, const char *field, rpmTag tag)
        /* are no spaces before it.                          */
        /* This also now allows for spaces and tabs between  */
        /* the number and the ':'                            */
+       char ch;
+       char *fieldp_backup = fieldp;
 
-       nump = buf;
        while ((*fieldp != ':') && (*fieldp != ' ') && (*fieldp != '\t')) {
-           *nump++ = *fieldp++;
+           fieldp++;
        }
-       *nump = '\0';
+       ch = *fieldp;
+       *fieldp = '\0';
 
-       nump = buf;
+       nump = fieldp_backup;
        SKIPSPACE(nump);
        if (nump == NULL || *nump == '\0') {
            num = 0;
        } else {
-           if (parseNum(buf, &num)) {
+           if (parseNum(fieldp_backup, &num)) {
                rpmlog(RPMLOG_ERR, _("line %d: Bad %s number: %s\n"),
                         spec->lineNum, name, spec->line);
+               *fieldp = ch;
                return RPMRC_FAIL;
            }
        }
+       *fieldp = ch;
     }
 
     /* Create the entry and link it in */
@@ -324,12 +327,14 @@ int addSource(rpmSpec spec, Package pkg, const char *field, rpmTag tag)
     if (tag != RPMTAG_ICON) {
        char *body = rpmGetPath("%{_sourcedir}/", p->source, NULL);
 
-       sprintf(buf, "%s%d",
+       rasprintf(&buf, "%s%d",
                (flag & RPMBUILD_ISPATCH) ? "PATCH" : "SOURCE", num);
        addMacro(spec->macros, buf, NULL, body, RMIL_SPEC);
-       sprintf(buf, "%sURL%d",
+       free(buf);
+       rasprintf(&buf, "%sURL%d",
                (flag & RPMBUILD_ISPATCH) ? "PATCH" : "SOURCE", num);
        addMacro(spec->macros, buf, NULL, p->fullSource, RMIL_SPEC);
+       free(buf);
 #ifdef WITH_LUA
        {
        rpmlua lua = NULL; /* global state */