search

rpm-software-management / rpm

The RPM package manager
http://rpm.org
Other
498 stars 359 forks source link

Segmentation fault when a recursive macro contains %[expression] #3197

Closed hroncok closed 2 months ago

hroncok commented 3 months ago

Describe the bug

This works as expected:

$ rpm --define 'aaa %aaa' --eval '%aaa'
error: Too many levels of recursion in macro expansion. It is likely caused by recursive macro declaration.

This crashes:

$ rpm --define 'aaa %[%aaa]' --eval '%aaa'
Segmentation fault (core dumped)

To Reproduce Run the command above.

Expected behavior An error should happen, not a crash.

Output See above.

Environment

hroncok commented 3 months ago 
(gdb) bt
#0  0x00007ffff7d6c4d4 in __printf_buffer () from /lib64/libc.so.6
#1  0x00007ffff7d92a73 in __vsnprintf_internal () from /lib64/libc.so.6
#2  0x00007ffff7f1a255 in vsnprintf (__s=0x0, __n=0, __fmt=<optimized out>, __ap=0x7fffff7ff4a0) at /usr/include/bits/stdio2.h:100
#3  rvasprintf (strp=strp@entry=0x7fffff7ff508, fmt=0x7ffff7f2d838 "Too many levels of recursion in macro expansion. It is likely caused by recursive macro declaration.\n", ap=ap@entry=0x7fffff7ff510)
    at /usr/src/debug/rpm-4.19.92-2.fc41.x86_64/rpmio/rpmstring.c:79
#4  0x00007ffff7f1f188 in rpmMacroBufErr (mb=mb@entry=0x555560191810, error=error@entry=1, fmt=<optimized out>) at /usr/src/debug/rpm-4.19.92-2.fc41.x86_64/rpmio/macro.c:329
#5  0x00007ffff7f1d95a in mbInit (med=<optimized out>, slen=<optimized out>, mb=0x555560191810) at /usr/src/debug/rpm-4.19.92-2.fc41.x86_64/rpmio/macro.c:492
#6  mbInit (mb=0x555560191810, med=0x7fffff7ff660, slen=<optimized out>) at /usr/src/debug/rpm-4.19.92-2.fc41.x86_64/rpmio/macro.c:487
#7  expandMacro (mb=mb@entry=0x555560191810, src=src@entry=0x5555601917b0 "%{?__file_name:%{__file_name}: }%{?__file_lineno:line %{__file_lineno}: }", slen=<optimized out>, slen@entry=0)
    at /usr/src/debug/rpm-4.19.92-2.fc41.x86_64/rpmio/macro.c:1602
#8  0x00007ffff7f1db8d in doExpandMacros (mc=mc@entry=0x7ffff7f37260 <rpmGlobalMacroContext_s>, src=src@entry=0x5555601917b0 "%{?__file_name:%{__file_name}: }%{?__file_lineno:line %{__file_lineno}: }", flags=flags@entry=0, 
    target=target@entry=0x7fffff7ff708) at /usr/src/debug/rpm-4.19.92-2.fc41.x86_64/rpmio/macro.c:1828
#9  0x00007ffff7f1df3f in rpmExpand (arg=arg@entry=0x7ffff7f2da40 "%{?__file_name:%{__file_name}: }") at /usr/src/debug/rpm-4.19.92-2.fc41.x86_64/rpmio/macro.c:2259
#10 0x00007ffff7f1f1d7 in rpmMacroBufErr (mb=mb@entry=0x55556018d630, error=error@entry=1, fmt=<optimized out>) at /usr/src/debug/rpm-4.19.92-2.fc41.x86_64/rpmio/macro.c:334
#11 0x00007ffff7f1d95a in mbInit (med=<optimized out>, slen=<optimized out>, mb=0x55556018d630) at /usr/src/debug/rpm-4.19.92-2.fc41.x86_64/rpmio/macro.c:492
#12 mbInit (mb=0x55556018d630, med=0x7fffff7ff970, slen=<optimized out>) at /usr/src/debug/rpm-4.19.92-2.fc41.x86_64/rpmio/macro.c:487
#13 expandMacro (mb=mb@entry=0x55556018d630, src=src@entry=0x55556018d5d0 "%{?__file_name:%{__file_name}: }%{?__file_lineno:line %{__file_lineno}: }", slen=<optimized out>, slen@entry=0)
    at /usr/src/debug/rpm-4.19.92-2.fc41.x86_64/rpmio/macro.c:1602
#14 0x00007ffff7f1db8d in doExpandMacros (mc=mc@entry=0x7ffff7f37260 <rpmGlobalMacroContext_s>, src=src@entry=0x55556018d5d0 "%{?__file_name:%{__file_name}: }%{?__file_lineno:line %{__file_lineno}: }", flags=flags@entry=0, 
    target=target@entry=0x7fffff7ffa18) at /usr/src/debug/rpm-4.19.92-2.fc41.x86_64/rpmio/macro.c:1828
#15 0x00007ffff7f1df3f in rpmExpand (arg=arg@entry=0x7ffff7f2da40 "%{?__file_name:%{__file_name}: }") at /usr/src/debug/rpm-4.19.92-2.fc41.x86_64/rpmio/macro.c:2259
#16 0x00007ffff7f1f1d7 in rpmMacroBufErr (mb=mb@entry=0x555560189450, error=error@entry=1, fmt=<optimized out>) at /usr/src/debug/rpm-4.19.92-2.fc41.x86_64/rpmio/macro.c:334
#17 0x00007ffff7f1d95a in mbInit (med=<optimized out>, slen=<optimized out>, mb=0x555560189450) at /usr/src/debug/rpm-4.19.92-2.fc41.x86_64/rpmio/macro.c:492
#18 mbInit (mb=0x555560189450, med=0x7fffff7ffc80, slen=<optimized out>) at /usr/src/debug/rpm-4.19.92-2.fc41.x86_64/rpmio/macro.c:487
#19 expandMacro (mb=mb@entry=0x555560189450, src=src@entry=0x5555601893f0 "%{?__file_name:%{__file_name}: }%{?__file_lineno:line %{__file_lineno}: }", slen=<optimized out>, slen@entry=0)
    at /usr/src/debug/rpm-4.19.92-2.fc41.x86_64/rpmio/macro.c:1602
...snip...

The backtrace suggests RPM goes down the recursion hole.