libdpkg: Escape package and architecture on control file parsing warning

The package and architecture names are injected into a variable that is
used as a format string. Because these are user controlled, we need to
format-escape them so that they become inert.

Regression introduced in commmit 3be2cf607868adb9a2c0e5af06f20168a072eeb6.

Fixes: CVE-2014-8625
Closes: #768485
Reporteb-by: Joshua Rogers <megamansec@gmail.com>

debian/changelog

@@ -10,6 +10,11 @@ dpkg (1.17.22) UNRELEASED; urgency=low
     so this got removed prematurely.
   * Add Breaks on old man-db, fontconfig and readahead-fedora packages using
     awaiting triggers, as they produce trigger cycles. Closes: #768599
+  * Escape package and architecture names on control file parsing warning,
+    as those get injected into a variable that is used as a format string,
+    and they come from the package fields, which are under user control.
+    Regression introduced in dpkg 1.16.0. Fixes CVE-2014-8625. Closes: #768485
+    Reported by Joshua Rogers <megamansec@gmail.com>.
 
   [ Updated programs translations ]
   * German (Sven Joachim).

lib/dpkg/parsehelp.c

@@ -44,11 +44,14 @@ parse_error_msg(struct parsedb_state *ps, const char *fmt)
 
   str_escape_fmt(filename, ps->filename, sizeof(filename));
 
-  if (ps->pkg && ps->pkg->set->name)
+  if (ps->pkg && ps->pkg->set->name) {
+    char pkgname[256];
+
+    str_escape_fmt(pkgname, pkgbin_name(ps->pkg, ps->pkgbin, pnaw_nonambig),
+                   sizeof(pkgname));
     sprintf(msg, _("parsing file '%.255s' near line %d package '%.255s':\n"
-                   " %.255s"), filename, ps->lno,
-                   pkgbin_name(ps->pkg, ps->pkgbin, pnaw_nonambig), fmt);
-  else
+                   " %.255s"), filename, ps->lno, pkgname, fmt);
+  } else
     sprintf(msg, _("parsing file '%.255s' near line %d:\n"
                    " %.255s"), filename, ps->lno, fmt);