Attachment 869468 Details for Bug 1215274

[patch] patch file fixing the issue

avoid-DoS-on-carefully-crafted-spec-files.patch (text/plain), 1.08 KB, created by Martin Schreiner on 2023-09-13 06:36:08 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Schreiner

Created: 2023-09-13 06:36:08 UTC

Size: 1.08 KB

patch

obsolete

>Index: python-rpm-spec-0.14.1/pyrpm/spec.py
>===================================================================
>--- python-rpm-spec-0.14.1.orig/pyrpm/spec.py
>+++ python-rpm-spec-0.14.1/pyrpm/spec.py
>@@ -490,7 +490,7 @@ class Spec:
>         return spec
> 
> 
>-def replace_macros(string: str, spec: Spec) -> str:
>+def replace_macros(string: str, spec: Spec, max_attempts: int = 1000) -> str:
>     """Replace all macros in given string with corresponding values.
> 
>     For example, a string '%{name}-%{version}.tar.gz' will be transformed to 'foo-2.0.tar.gz'.
>@@ -552,10 +552,12 @@ def replace_macros(string: str, spec: Sp
> 
>         return match.string[match.start() : match.end()]
> 
>-    # Recursively expand macros
>+    # Recursively expand macros, respecting the limit imposed by 'max_attempts'
>     # Note: If macros are not defined in the spec file, this won't try to
>     # expand them.
>-    while True:
>+    attempt = 0
>+    while attempt < max_attempts:
>+        attempt += 1
>         ret = re.sub(_macro_pattern, get_replacement_string, string)
>         if ret != string:
>             string = ret

Actions: View | Diff

Attachments on bug 1215274: 869468