From: Zhipeng Xie <xiezhipeng1@huawei.com>
Date: Tue, 6 Aug 2019 01:50:57 +0000 (+0800)
Subject: repodata_schema2id: fix heap-buffer-overflow in memcmp
X-Git-Tag: 0.6.37~16
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=42e705ca567e21d69c1fc100f598598259c7e2e9;p=thirdparty%2Flibsolv.git

repodata_schema2id: fix heap-buffer-overflow in memcmp

When the length of last schema in data->schemadata is
less than length of input schema, we got a read overflow
in asan test.

Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com>
---

diff --git a/src/repodata.c b/src/repodata.c
index 4ab5d188..94c15ce0 100644
--- a/src/repodata.c
+++ b/src/repodata.c
@@ -205,11 +205,13 @@ repodata_schema2id(Repodata *data, Id *schema, int create)
   cid = schematahash[h];
   if (cid)
     {
-      if (!memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))
+      if ((data->schemata[cid] + len <= data->schemadatalen) &&
+			  !memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))
         return cid;
       /* cache conflict, do a slow search */
       for (cid = 1; cid < data->nschemata; cid++)
-        if (!memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))
+        if ((data->schemata[cid] + len <= data->schemadatalen) &&
+				!memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))
           return cid;
     }
   /* a new one */