dcavalca / rpms / rpm

Forked from rpms/rpm 2 years ago
Clone

Blame SOURCES/0001-Fix-segfault-on-fingerprinting-symlink-round-RhBug-1.patch

83a7c7
From 050b392f8c11d111379e0d2bac52762beb97b3ae Mon Sep 17 00:00:00 2001
83a7c7
Message-Id: <050b392f8c11d111379e0d2bac52762beb97b3ae.1559645935.git.pmatilai@redhat.com>
83a7c7
From: Panu Matilainen <pmatilai@redhat.com>
83a7c7
Date: Tue, 2 Apr 2019 12:57:11 +0300
83a7c7
Subject: [PATCH] Fix segfault on fingerprinting symlink round (RhBug:1660232)
83a7c7
83a7c7
Both yum and dnf perform a test-transaction before the real thing,
83a7c7
and both neglet to check for an error code from the test-transaction
83a7c7
when there are no problem objects to return. Which can happen in
83a7c7
some special cases, such a using different vsflags between initial
83a7c7
package read and transaction (which is what both yum and dnf do),
83a7c7
which can cause the in-transaction package open fail on corrupt packages.
83a7c7
And when this failed transaction is fed back to rpmtsRun(), it
83a7c7
segfaults in fingerprinting as the second loop of symlink checking
83a7c7
doesn't check for NULL's element files like the first loop does.
83a7c7
83a7c7
Add the missing NULL check and remove bogus "can't happen" comment to fix.
83a7c7
83a7c7
FWIW, the scenario with different vsflags and corrupted packages doesn't
83a7c7
happen by default in rpm >= 4.14.2, the corrupt package gets caught
83a7c7
in the verify stage which does create problem objects and thus both
83a7c7
yum and dnf abort as they should.
83a7c7
---
83a7c7
 lib/fprint.c | 6 +++++-
83a7c7
 1 file changed, 5 insertions(+), 1 deletion(-)
83a7c7
83a7c7
diff --git a/lib/fprint.c b/lib/fprint.c
83a7c7
index b810e4d2b..ab1891961 100644
83a7c7
--- a/lib/fprint.c
83a7c7
+++ b/lib/fprint.c
83a7c7
@@ -488,7 +488,7 @@ void fpCachePopulate(fingerPrintCache fpc, rpmts ts, int fileCount)
83a7c7
 	(void) rpmsqPoll();
83a7c7
 
83a7c7
 	if ((fi = rpmteFiles(p)) == NULL)
83a7c7
-	    continue;	/* XXX can't happen */
83a7c7
+	    continue;
83a7c7
 
83a7c7
 	(void) rpmswEnter(rpmtsOp(ts, RPMTS_OP_FINGERPRINT), 0);
83a7c7
 	rpmfilesFpLookup(fi, fpc);
83a7c7
@@ -522,6 +522,9 @@ void fpCachePopulate(fingerPrintCache fpc, rpmts ts, int fileCount)
83a7c7
     while ((p = rpmtsiNext(pi, 0)) != NULL) {
83a7c7
 	(void) rpmsqPoll();
83a7c7
 
83a7c7
+	if ((fi = rpmteFiles(p)) == NULL)
83a7c7
+	    continue;
83a7c7
+
83a7c7
 	fs = rpmteGetFileStates(p);
83a7c7
 	fc = rpmfsFC(fs);
83a7c7
 	(void) rpmswEnter(rpmtsOp(ts, RPMTS_OP_FINGERPRINT), 0);
83a7c7
@@ -531,6 +534,7 @@ void fpCachePopulate(fingerPrintCache fpc, rpmts ts, int fileCount)
83a7c7
 	    fpLookupSubdir(symlinks, fpc, p, i);
83a7c7
 	}
83a7c7
 	(void) rpmswExit(rpmtsOp(ts, RPMTS_OP_FINGERPRINT), 0);
83a7c7
+	rpmfilesFree(fi);
83a7c7
     }
83a7c7
     rpmtsiFree(pi);
83a7c7
 
83a7c7
-- 
83a7c7
2.21.0
83a7c7