In pkgconf through 1.9.3, variable duplication can cause...
Critical severity
Unreviewed
Published
Jan 22, 2023
to the GitHub Advisory Database
•
Updated Feb 3, 2023
Description
Published by the National Vulnerability Database
Jan 22, 2023
Published to the GitHub Advisory Database
Jan 22, 2023
Last updated
Feb 3, 2023
In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.
References