From 50d71507b28ccb4954b4de5acbe284def297fac4 Mon Sep 17 00:00:00 2001
From: Petr Písař <ppisar@redhat.com>
Date: May 19 2023 16:25:27 +0000
Subject: Fix tag2_name_cpy[] size


The test crashes in Fedora 39 with gcc-13.1.1-2.fc39 and
glibc-2.37.9000-10.fc39.x86_64:

|    + ./test
|    *** buffer overflow detected ***: terminated
|    0a1,14
|    > 043436006cb582879b8d66503e755a22bcd8b13e tag-1-2
|    > d882aa1b41767801307cf18b08c3653ee22eca35 tag-11-1
|    > 11344b06b32f18534d921cb22a001db21058e7af tag-10-1
|    > 6fecf2e24af75b97ae857d6f8b58ee54a74b7d2d tag-9-1
|    > fa9dd254964d602202e09e43017f67d484903618 tag-5-1
|    > f617549126a44e6cceea5384623dede4cd76beb5 tag-8-3
|    > 5334bc27d2312b7b512733f625ade86bd19f7edd tag-8-2
|    > e5cc783757f61e7e7179394a989b0bf6bd8b771d tag-8-1
|    > 1097c7de63a35207f32c3232a1f4253ad0ec2e4e tag-8-0
|    > 335cae5db0ac482dfd3e8ec972831dc0b74ca030 tag-7-1
|    > 9b0975c3aaeea59ebdcf69ae23d331c7c97cd97a tag-6-1
|    > 379b113d3447c00c499b2a048cda13878c10e79a tag-3-1
|    > 5c48f70428673549517763d984ab06019791c8bf tag-4-1
|    > 13841e1b08e7c90c651ce8bf9acb0312e14841b8 tag-1-1
|    fail.
|    error: Bad exit status from /var/tmp/rpm-tmp.Zd3mzx (%build)

The reason is a typo in tag2_name_cpy[] definition. It has a wrong size:

	/* copy tag names */
	char tag1_name_cpy[strlen(tag1_name) + 1];
	char tag2_name_cpy[strlen(tag1_name) + 1];
	strcpy(tag1_name_cpy, tag1_name);
    ->  strcpy(tag2_name_cpy, tag2_name);

    tag2_name_cpy is too short to hold tag2_name:

    (gdb) p tag1_name
    $1 = 0x52d700 "tag-9-1"
    (gdb) p tag2_name
    $2 = 0x538fe0 "tag-10-1"

This patch fixes the typo. Then the test passes.

https://bugzilla.redhat.com/show_bug.cgi?id=2208579

---

diff --git a/main.c b/main.c
index 979dac6..ade8fcb 100644
--- a/main.c
+++ b/main.c
@@ -129,7 +129,7 @@ bool rpm_is_lower_than(char * tag1_name, char * tag2_name) {
 
     /* copy tag names */
     char tag1_name_cpy[strlen(tag1_name) + 1];
-    char tag2_name_cpy[strlen(tag1_name) + 1];
+    char tag2_name_cpy[strlen(tag2_name) + 1];
     strcpy(tag1_name_cpy, tag1_name);
     strcpy(tag2_name_cpy, tag2_name);