diff --git a/Source/cmPackageInfoReader.cxx b/Source/cmPackageInfoReader.cxx index 3c7c9707fa..6ee574c1f5 100644 --- a/Source/cmPackageInfoReader.cxx +++ b/Source/cmPackageInfoReader.cxx @@ -137,8 +137,14 @@ bool CheckSchemaVersion(Json::Value const& data) bool ComparePathSuffix(std::string const& path, std::string const& suffix) { - std::string const& tail = path.substr(path.size() - suffix.size()); - return cmSystemTools::ComparePath(tail, suffix); + std::string::size_type const ps = path.size(); + std::string::size_type const ss = suffix.size(); + + if (ss > ps) { + return false; + } + + return cmSystemTools::ComparePath(path.substr(ps - ss), suffix); } std::string DeterminePrefix(std::string const& filepath, diff --git a/Tests/RunCMake/find_package-CPS/BadPrefix-result.txt b/Tests/RunCMake/find_package-CPS/BadPrefix1-result.txt similarity index 100% rename from Tests/RunCMake/find_package-CPS/BadPrefix-result.txt rename to Tests/RunCMake/find_package-CPS/BadPrefix1-result.txt diff --git a/Tests/RunCMake/find_package-CPS/BadPrefix-stderr.txt b/Tests/RunCMake/find_package-CPS/BadPrefix1-stderr.txt similarity index 54% rename from Tests/RunCMake/find_package-CPS/BadPrefix-stderr.txt rename to Tests/RunCMake/find_package-CPS/BadPrefix1-stderr.txt index bec724e6bb..f0716f1f38 100644 --- a/Tests/RunCMake/find_package-CPS/BadPrefix-stderr.txt +++ b/Tests/RunCMake/find_package-CPS/BadPrefix1-stderr.txt @@ -1,11 +1,11 @@ -CMake Error at BadPrefix\.cmake:[0-9]+ \(find_package\): - Could not find a configuration file for package "BadPrefix" that is +CMake Error at BadPrefix1\.cmake:[0-9]+ \(find_package\): + Could not find a configuration file for package "BadPrefix1" that is compatible with requested version ""\. The following configuration files were considered but not accepted: ( [^ -]*/Tests/RunCMake/find_package-CPS/cps/[Bb]ad[Pp]refix\.cps, version: unknown +]*/Tests/RunCMake/find_package-CPS/cps/[Bb]ad[Pp]refix1\.cps, version: unknown The package description file could not be read\.)+ Call Stack \(most recent call first\): diff --git a/Tests/RunCMake/find_package-CPS/BadPrefix.cmake b/Tests/RunCMake/find_package-CPS/BadPrefix1.cmake similarity index 90% rename from Tests/RunCMake/find_package-CPS/BadPrefix.cmake rename to Tests/RunCMake/find_package-CPS/BadPrefix1.cmake index 483bbaca31..644ec5c71d 100644 --- a/Tests/RunCMake/find_package-CPS/BadPrefix.cmake +++ b/Tests/RunCMake/find_package-CPS/BadPrefix1.cmake @@ -8,4 +8,4 @@ set(CMAKE_FIND_PACKAGE_SORT_DIRECTION DEC) ############################################################################### # Test reporting when trying to read a .cps whose absolute prefix cannot be # determined. -find_package(BadPrefix REQUIRED) +find_package(BadPrefix1 REQUIRED) diff --git a/Tests/RunCMake/find_package-CPS/BadPrefix2-result.txt b/Tests/RunCMake/find_package-CPS/BadPrefix2-result.txt new file mode 100644 index 0000000000..d00491fd7e --- /dev/null +++ b/Tests/RunCMake/find_package-CPS/BadPrefix2-result.txt @@ -0,0 +1 @@ +1 diff --git a/Tests/RunCMake/find_package-CPS/BadPrefix2-stderr.txt b/Tests/RunCMake/find_package-CPS/BadPrefix2-stderr.txt new file mode 100644 index 0000000000..f0b9318e9a --- /dev/null +++ b/Tests/RunCMake/find_package-CPS/BadPrefix2-stderr.txt @@ -0,0 +1,12 @@ +CMake Error at BadPrefix2\.cmake:[0-9]+ \(find_package\): + Could not find a configuration file for package "BadPrefix2" that is + compatible with requested version ""\. + + The following configuration files were considered but not accepted: +( + [^ +]*/Tests/RunCMake/find_package-CPS/cps/[Bb]ad[Pp]refix2\.cps, version: unknown + The package description file could not be read\.)+ + +Call Stack \(most recent call first\): + CMakeLists\.txt:3 \(include\) diff --git a/Tests/RunCMake/find_package-CPS/BadPrefix2.cmake b/Tests/RunCMake/find_package-CPS/BadPrefix2.cmake new file mode 100644 index 0000000000..95b6069b49 --- /dev/null +++ b/Tests/RunCMake/find_package-CPS/BadPrefix2.cmake @@ -0,0 +1,13 @@ +cmake_minimum_required(VERSION 4.0) + +include(Setup.cmake) + +set(CMAKE_FIND_PACKAGE_SORT_ORDER NAME) +set(CMAKE_FIND_PACKAGE_SORT_DIRECTION DEC) + +############################################################################### +# Test that trying to read a .cps whose claimed prefix is longer than its +# actual prefix doesn't crash CMake. +# +# https://gitlab.kitware.com/cmake/cmake/-/issues/27631 +find_package(BadPrefix2 REQUIRED) diff --git a/Tests/RunCMake/find_package-CPS/RunCMakeTest.cmake b/Tests/RunCMake/find_package-CPS/RunCMakeTest.cmake index 944b80b9c7..73ff7f0b5e 100644 --- a/Tests/RunCMake/find_package-CPS/RunCMakeTest.cmake +++ b/Tests/RunCMake/find_package-CPS/RunCMakeTest.cmake @@ -34,7 +34,8 @@ run_cmake(InvalidCps1) run_cmake(InvalidCps2) run_cmake(InvalidCps3) run_cmake(WrongName) -run_cmake(BadPrefix) +run_cmake(BadPrefix1) +run_cmake(BadPrefix2) # Version-matching tests run_cmake(ExactVersion) diff --git a/Tests/RunCMake/find_package-CPS/cps/badprefix.cps b/Tests/RunCMake/find_package-CPS/cps/badprefix1.cps similarity index 77% rename from Tests/RunCMake/find_package-CPS/cps/badprefix.cps rename to Tests/RunCMake/find_package-CPS/cps/badprefix1.cps index 54c11c26c5..8640951e3b 100644 --- a/Tests/RunCMake/find_package-CPS/cps/badprefix.cps +++ b/Tests/RunCMake/find_package-CPS/cps/badprefix1.cps @@ -1,6 +1,6 @@ { "cps_version": "0.13", - "name": "BadPrefix", + "name": "BadPrefix1", "cps_path": "@prefix@/share/cps", "components": {} } diff --git a/Tests/RunCMake/find_package-CPS/cps/badprefix2.cps b/Tests/RunCMake/find_package-CPS/cps/badprefix2.cps new file mode 100644 index 0000000000..5382861cbc --- /dev/null +++ b/Tests/RunCMake/find_package-CPS/cps/badprefix2.cps @@ -0,0 +1,6 @@ +{ + "cps_version": "0.13", + "name": "BadPrefix2", + "cps_path": "@prefix@/if the specified prefix is longer than the actual prefix, it obviously doesn't match/however, the code to compare path tails just subtracted without checking/that could cause CMake to try to pass a negative number as a string offset/that would result in an indexing error that could lead to a seg-fault/since we don't know where the test is running, it's hard to ensure that this string is longer than the actual path/so let's just make it absurdly long and hope for the best/this should be okay on at least some instances, which will be enough to let us know if there's still a problem/cps", + "components": {} +}