libdpkg: Fix buffer overflow in dpkg_ar_member_put_header

It was causing it to write the header to fd 0 (instead of ar_fd)
depending on the stack layout, affecting armel which was generating
empty packages.

Closes: #591312

Reported-by: Philipp Kern <pkern@debian.org>
Based-on-patch-by: Reinhard Tartler <siretart@tauware.de>

debian/changelog

@@ -1,9 +1,16 @@
 dpkg (1.15.8.3) UNRELEASED; urgency=low
 
+  [ Raphaël Hertzog ]
   * Fix dpkg-divert test suite to cope with + and other special characters for
     regexps in the build directory name. Thanks to Jonathan Nieder for the
     patch and to Phil Kern for the report. Closes: #591182
 
+  [ Guillem Jover ]
+  * Fix buffer overflow in dpkg_ar_member_put_header causing it to write the
+    header to fd 0 (instead of ar_fd) depending on the stack layout, affecting
+    armel. Thanks to Phil Kern for the analysis and Reinhard Tartler for the
+    initial patch. Closes: #591312
+
  -- Raphaël Hertzog <hertzog@debian.org>  Sun, 01 Aug 2010 08:54:39 +0200
 
 dpkg (1.15.8.2) unstable; urgency=low

lib/dpkg/ar.c

@@ -58,12 +58,15 @@ void
 dpkg_ar_member_put_header(const char *ar_name, int ar_fd,
                           const char *name, size_t size)
 {
-	char header[sizeof(struct ar_hdr)];
+	char header[sizeof(struct ar_hdr) + 1];
+	int n;
 
-	sprintf(header, "%-16s%-12lu0     0     100644  %-10lu`\n",
-	        name, time(NULL), (unsigned long)size);
+	n = sprintf(header, "%-16s%-12lu0     0     100644  %-10lu`\n",
+	            name, time(NULL), (unsigned long)size);
+	if (n != sizeof(struct ar_hdr))
+		ohshit(_("generated corrupt ar header for '%s'"), ar_name);
 
-	if (write(ar_fd, header, sizeof(header)) < 0)
+	if (write(ar_fd, header, n) < 0)
 		ohshite(_("unable to write file '%s'"), ar_name);
 }