14
0
Files
python-python-rpm-spec/avoid-DoS-on-carefully-crafted-spec-files.patch

29 lines
1.1 KiB
Diff
Raw Normal View History

Index: python-rpm-spec-0.14.1/pyrpm/spec.py
===================================================================
--- python-rpm-spec-0.14.1.orig/pyrpm/spec.py
+++ python-rpm-spec-0.14.1/pyrpm/spec.py
@@ -490,7 +490,7 @@ class Spec:
return spec
-def replace_macros(string: str, spec: Spec) -> str:
+def replace_macros(string: str, spec: Spec, max_attempts: int = 1000) -> str:
"""Replace all macros in given string with corresponding values.
For example, a string '%{name}-%{version}.tar.gz' will be transformed to 'foo-2.0.tar.gz'.
@@ -552,10 +552,12 @@ def replace_macros(string: str, spec: Sp
return match.string[match.start() : match.end()]
- # Recursively expand macros
+ # Recursively expand macros, respecting the limit imposed by 'max_attempts'
# Note: If macros are not defined in the spec file, this won't try to
# expand them.
- while True:
+ attempt = 0
+ while attempt < max_attempts:
+ attempt += 1
ret = re.sub(_macro_pattern, get_replacement_string, string)
if ret != string:
string = ret