[rpms/libx86emu] epel10.2: Fix logging buffer overflow

[Lubomir Rintel <lkundrak@v3.sk>]

A new commit has been pushed.

Repo   : rpms/libx86emu
Branch : epel10.2
Commit : f6d25d18691d52afa2e8d6e3df1ac7c6239c03c7
Author : Lubomir Rintel <lkundrak@v3.sk>
Date   : 2024-12-31T20:52:45+01:00
Stats  : +59/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/libx86emu/c/f6d25d18691d52afa2e8d6e3df1ac7c6239c03c7?branch=epel10.2

Log:
Fix logging buffer overflow

---
diff --git a/libx86emu-log-overflow.patch b/libx86emu-log-overflow.patch
new file mode 100644
index 0000000..8cb4569
--- /dev/null
+++ b/libx86emu-log-overflow.patch
@@ -0,0 +1,56 @@
+From cfbbe1fcecfbff0b4b51e6060b793252ad942db1 Mon Sep 17 00:00:00 2001
+From: Lubomir Rintel <lkundrak@v3.sk>
+Date: Fri, 1 Nov 2024 14:03:38 +0100
+Subject: [PATCH] api: fix a buffer overflow in x86emu_log()
+
+There seems to be an assumption that vsnprintf() returns a number of
+characters that were written. That is actually not the case -- it
+returns number of characters that *would* have been written regardless
+of truncation to specified size.
+
+Therefore, on x86emu_log() that would cross the buffer end will move
+.log.ptr beyond the end of the buffer, and the subsequent .flush()
+will be called back with a size argument larger than the buffer.
+
+Moreover, given the .flush() is essentially only invoked upon
+x86emu_clear_log(), this is almost bound to happen for instances that
+run for a long time.
+
+Let's solve the buffer fillup differently: 1.) flush the buffer when it
+fills up (we'd be crossing the buffer boundary) and 2.) make sure
+.log.ptr is allways clipped to point inside the allocated buffer.
+---
+ api.c | 18 ++++++++----------
+ 1 file changed, 8 insertions(+), 10 deletions(-)
+
+diff --git a/api.c b/api.c
+index 71a46ae..f76e64a 100644
+--- a/api.c
++++ b/api.c
+@@ -337,18 +337,16 @@ API_SYM void x86emu_log(x86emu_t *emu, const char *format, ...)
+ 
+   if(!emu || !emu->log.ptr) return;
+ 
+-  size = emu->log.size - (emu->log.ptr - emu->log.buf);
+-
+   va_start(args, format);
+-  if(size > 0) {
+-    size = vsnprintf(emu->log.ptr, size, format, args);
+-    if(size > 0) {
+-      emu->log.ptr += size;
+-    }
+-    else {
+-      *emu->log.ptr = 0;
+-    }
++  size = vsnprintf(emu->log.ptr, LOG_FREE(emu), format, args);
++  if (emu->log.ptr + size > emu->log.buf + emu->log.size) {
++    x86emu_clear_log(emu, 1);
++    size = vsnprintf(emu->log.ptr, emu->log.size, format, args);
+   }
++  if (size > 0)
++    emu->log.ptr += size;
++  if (emu->log.ptr > emu->log.buf + emu->log.size)
++    emu->log.ptr = emu->log.buf + emu->log.size;
+   va_end(args);  
+ }
+ 

diff --git a/libx86emu.spec b/libx86emu.spec
index 19d0fe2..5808ae5 100644
--- a/libx86emu.spec
+++ b/libx86emu.spec
@@ -20,6 +20,8 @@ Source0:        https://github.com/wfeldt/libx86emu/archive/%{version}/%{name}-%
 
 # Make it build outside x86. Not submitted upstream because I don't know what is going on.
 Patch0:         libx86emu-3.5-x86-io.patch
+# Submitted upstream: https://github.com/wfeldt/libx86emu/pull/45
+Patch1:         https://github.com/wfeldt/libx86emu/commit/cfbbe1fcecfbff0b4b51e6060b793252ad942db1.patch#/libx86emu-log-overflow.patch
 
 BuildRequires:  gcc
 BuildRequires:  make
@@ -69,6 +71,7 @@ library.
 %changelog
 * Tue Dec 31 2024 Lubomir Rintel <lkundrak@v3.sk> - 3.5-9
 - Make it build outside x86 again
+- Fix logging buffer overflow
 
 * Mon Sep 02 2024 Miroslav Suchý <msuchy@redhat.com> - 3.5-8
 - convert license to SPDX