libdpkg: Fix theoretical stack buffer overflow in w_dependency()

If the dependency field name is longer than 49 chars then there will
be a stack buffer overlow.

But the function is only ever going to be called from known field
names, from the fieldinfos table. So it's currently not possible to
trigger this from the dpkg code base, but fixing it now will avoid
future unpleasant surprises.

Reported-by: Pedro Ribeiro <pedrib@gmail.com>

debian/changelog

@@ -18,6 +18,8 @@ dpkg (1.17.2) UNRELEASED; urgency=low
     Reported by Pedro Ribeiro <pedrib@gmail.com>.
   * Fix use after free in dpkg_arch_load_list() on libdpkg.
     Reported by Pedro Ribeiro <pedrib@gmail.com>.
+  * Fix theoretical stack buffer overflow in w_dependency() on libdpkg, not
+    currently applicable. Reported by Pedro Ribeiro <pedrib@gmail.com>.
 
  -- Guillem Jover <guillem@debian.org>  Sun, 28 Jul 2013 15:06:29 +0200
 

lib/dpkg/dump.c

@@ -337,24 +337,23 @@ w_dependency(struct varbuf *vb,
              const struct pkginfo *pkg, const struct pkgbin *pkgbin,
              enum fwriteflags flags, const struct fieldinfo *fip)
 {
-  char fnbuf[50];
-  const char *depdel;
   struct dependency *dyp;
+  bool dep_found = false;
 
-  if (flags&fw_printheader)
-    sprintf(fnbuf,"%s: ",fip->name);
-  else
-    fnbuf[0] = '\0';
-
-  depdel= fnbuf;
   for (dyp = pkgbin->depends; dyp; dyp = dyp->next) {
     if (dyp->type != fip->integer) continue;
     assert(dyp->up == pkg);
-    varbuf_add_str(vb, depdel);
-    depdel = ", ";
+
+    if (dep_found) {
+      varbuf_add_str(vb, ", ");
+    } else {
+      if (flags & fw_printheader)
+        varbuf_add_fieldname(vb, fip);
+      dep_found = true;
+    }
     varbufdependency(vb,dyp);
   }
-  if ((flags&fw_printheader) && (depdel!=fnbuf))
+  if ((flags & fw_printheader) && dep_found)
     varbuf_add_char(vb, '\n');
 }