2 * Copyright (c) 2007, Novell Inc.
4 * This program is licensed under the BSD license, read LICENSE.BSD
5 * for further information
11 #include <sys/types.h>
21 #include "repo_updateinfoxml.h"
22 #include "tools_util.h"
26 * <update from="rel-eng@fedoraproject.org" status="stable" type="security" version="1.4">
27 * <id>FEDORA-2007-4594</id>
28 * <title>imlib-1.9.15-6.fc8</title>
29 * <release>Fedora 8</release>
30 * <issued date="2007-12-28 16:42:30"/>
32 * <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=426091" id="426091" title="CVE-2007-3568 imlib: infinite loop DoS using crafted BMP image" type="bugzilla"/>
34 * <description>This update includes a fix for a denial-of-service issue (CVE-2007-3568) whereby an attacker who could get an imlib-using user to view a specially-crafted BMP image could cause the user's CPU to go into an infinite loop.</description>
36 * <collection short="F8">
37 * <name>Fedora 8</name>
38 * <package arch="ppc64" name="imlib-debuginfo" release="6.fc8" src="http://download.fedoraproject.org/pub/fedora/linux/updates/8/ppc64/imlib-debuginfo-1.9.15-6.fc8.ppc64.rpm" version="1.9.15">
39 * <filename>imlib-debuginfo-1.9.15-6.fc8.ppc64.rpm</filename>
40 * <reboot_suggested>True</reboot_suggested>
50 STATE_UPDATES, /* 1 */
54 STATE_RELEASE, /* 5 */
56 STATE_MESSAGE, /* 7 */
57 STATE_REFERENCES, /* 8 */
58 STATE_REFERENCE, /* 9 */
59 STATE_DESCRIPTION, /* 10 */
60 STATE_PKGLIST, /* 11 */
61 STATE_COLLECTION, /* 12 */
63 STATE_PACKAGE, /* 14 */
64 STATE_FILENAME, /* 15 */
65 STATE_REBOOT, /* 16 */
66 STATE_RESTART, /* 17 */
67 STATE_RELOGIN, /* 18 */
79 /* !! must be sorted by first column !! */
80 static struct stateswitch stateswitches[] = {
81 { STATE_START, "updates", STATE_UPDATES, 0 },
82 { STATE_START, "update", STATE_UPDATE, 0 },
83 { STATE_UPDATES, "update", STATE_UPDATE, 0 },
84 { STATE_UPDATE, "id", STATE_ID, 1 },
85 { STATE_UPDATE, "title", STATE_TITLE, 1 },
86 { STATE_UPDATE, "release", STATE_RELEASE, 1 },
87 { STATE_UPDATE, "issued", STATE_ISSUED, 1 },
88 { STATE_UPDATE, "description", STATE_DESCRIPTION, 1 },
89 { STATE_UPDATE, "message", STATE_MESSAGE , 1 },
90 { STATE_UPDATE, "references", STATE_REFERENCES, 0 },
91 { STATE_UPDATE, "pkglist", STATE_PKGLIST, 0 },
92 { STATE_REFERENCES, "reference", STATE_REFERENCE, 0 },
93 { STATE_PKGLIST, "collection", STATE_COLLECTION, 0 },
94 { STATE_COLLECTION, "name", STATE_NAME, 1 },
95 { STATE_COLLECTION, "package", STATE_PACKAGE, 0 },
96 { STATE_PACKAGE, "filename", STATE_FILENAME, 1 },
97 { STATE_PACKAGE, "reboot_suggested",STATE_REBOOT, 1 },
98 { STATE_PACKAGE, "restart_suggested",STATE_RESTART, 1 },
99 { STATE_PACKAGE, "relogin_suggested",STATE_RELOGIN, 1 },
114 unsigned int datanum;
116 unsigned int timestamp;
119 struct stateswitch *swtab[NUMSTATES];
120 enum state sbtab[NUMSTATES];
127 * if we have seen a <filename>...
128 * inside of <package>...
131 * If not, we must insert an empty filename to UPDATE_COLLECTION_FILENAME
132 * at </package> in order to keep all UPDATE_COLLECTION_* arrays in sync
135 static int package_filename_seen = 0;
136 static int package_flags = 0; /* same for reboot/restart flags, to be written at </package> */
144 find_attr(const char *txt, const char **atts)
146 for (; *atts; atts += 2)
148 if (!strcmp(*atts, txt))
155 * create evr (as Id) from 'epoch', 'version' and 'release' attributes
159 makeevr_atts(Pool *pool, struct parsedata *pd, const char **atts)
161 const char *e, *v, *r, *v2;
166 for (; *atts; atts += 2)
168 if (!strcmp(*atts, "epoch"))
170 else if (!strcmp(*atts, "version"))
172 else if (!strcmp(*atts, "release"))
175 if (e && !strcmp(e, "0"))
179 for (v2 = v; *v2 >= '0' && *v2 <= '9'; v2++)
181 if (v2 > v && *v2 == ':')
191 if (l > pd->acontent)
193 pd->content = realloc(pd->content, l + 256);
194 pd->acontent = l + 256;
218 fprintf(stderr, "evr: %s\n", pd->content);
220 return str2id(pool, pd->content, 1);
226 startElement(void *userData, const char *name, const char **atts)
228 struct parsedata *pd = userData;
229 Pool *pool = pd->pool;
230 Solvable *solvable = pd->solvable;
231 struct stateswitch *sw;
232 /*const char *str; */
235 fprintf(stderr, "start: [%d]%s\n", pd->state, name);
237 if (pd->depth != pd->statedepth)
244 for (sw = pd->swtab[pd->state]; sw->from == pd->state; sw++) /* find name in statetable */
245 if (!strcmp(sw->ename, name))
249 if (sw->from != pd->state)
252 fprintf(stderr, "into unknown: [%d]%s (from: %d)\n", sw->to, name, sw->from);
258 pd->docontent = sw->docontent;
259 pd->statedepth = pd->depth;
270 * <update from="rel-eng@fedoraproject.org"
272 * type="bugfix" (enhancement, security)
277 const char *from = 0, *status = 0, *type = 0, *version = 0;
278 for (; *atts; atts += 2)
280 if (!strcmp(*atts, "from"))
282 else if (!strcmp(*atts, "status"))
284 else if (!strcmp(*atts, "type"))
286 else if (!strcmp(*atts, "version"))
291 solvable = pd->solvable = pool_id2solvable(pool, repo_add_solvable(pd->repo));
292 pd->datanum = (pd->solvable - pool->solvables) - pd->repo->start;
293 repodata_extend(pd->data, pd->solvable - pool->solvables);
294 repodata_extend(pd->data, pd->solvable - pool->solvables);
295 pd->datanum = repodata_get_handle(pd->data, pd->datanum);
298 solvable->vendor = str2id(pool, from, 1);
299 solvable->evr = str2id(pool, version, 1);
300 solvable->arch = ARCH_NOARCH;
301 repodata_set_str(pd->data, pd->datanum, SOLVABLE_PATCHCATEGORY, type);
304 /* <id>FEDORA-2007-4594</id> */
307 /* <title>imlib-1.9.15-6.fc8</title> */
310 /* <release>Fedora 8</release> */
313 /* <issued date="2008-03-21 21:36:55"/>
317 const char *date = 0;
318 for (; *atts; atts += 2)
320 if (!strcmp(*atts, "date"))
323 repodata_set_str(pd->data, pd->datanum, SOLVABLE_BUILDTIME, date);
326 case STATE_REFERENCES:
328 /* <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=330471"
330 * title="LDAP schema file missing for dhcpd"
333 case STATE_REFERENCE:
335 const char *href = 0, *id = 0, *title = 0, *type = 0;
336 for (; *atts; atts += 2)
338 if (!strcmp(*atts, "href"))
340 else if (!strcmp(*atts, "id"))
342 else if (!strcmp(*atts, "title"))
344 else if (!strcmp(*atts, "type"))
348 repodata_add_poolstr_array(pd->data, pd->datanum, UPDATE_REFERENCE_HREF, href);
349 repodata_add_poolstr_array(pd->data, pd->datanum, UPDATE_REFERENCE_ID, id);
350 repodata_add_poolstr_array(pd->data, pd->datanum, UPDATE_REFERENCE_TITLE, title);
351 repodata_add_poolstr_array(pd->data, pd->datanum, UPDATE_REFERENCE_TYPE, type);
355 /* <description>This update ...</description> */
356 case STATE_DESCRIPTION:
358 /* <message type="confirm">This update ...</message> */
363 /* <collection short="F8" id="PRODUCT0001444"> */
364 case STATE_COLLECTION:
366 /* insert a REPOSITORY_UPDATES for every present collection id */
368 if ((cid = find_attr("id", atts)))
369 repodata_add_poolstr_array(pd->data, -1, REPOSITORY_UPDATES, cid);
372 /* <name>Fedora 8</name> */
375 /* <package arch="ppc64" name="imlib-debuginfo" release="6.fc8"
376 * src="http://download.fedoraproject.org/pub/fedora/linux/updates/8/ppc64/imlib-debuginfo-1.9.15-6.fc8.ppc64.rpm"
380 * -> patch.conflicts: {name} < {version}.{release}
384 const char *arch = 0, *name = 0, *src = 0;
385 Id evr = makeevr_atts(pool, pd, atts); /* parse "epoch", "version", "release" */
390 /* reset package_* markers, to be evaluated at </package> */
391 package_filename_seen = 0;
395 for (; *atts; atts += 2)
397 if (!strcmp(*atts, "arch"))
399 else if (!strcmp(*atts, "name"))
401 else if (!strcmp(*atts, "src"))
404 /* generated Ids for name and arch */
405 n = str2id(pool, name, 1);
407 a = str2id(pool, arch, 1);
410 /* now combine both to a single Id */
411 na = rel2id(pool, n, a, REL_ARCH, 1);
414 rel_id = rel2id(pool, na, evr, REL_LT, 1);
416 solvable->conflicts = repo_addid_dep(pd->repo, solvable->conflicts, rel_id, 0);
418 repodata_add_idarray(pd->data, pd->datanum, UPDATE_COLLECTION_NAME, n);
419 repodata_add_idarray(pd->data, pd->datanum, UPDATE_COLLECTION_EVR, evr);
420 repodata_add_idarray(pd->data, pd->datanum, UPDATE_COLLECTION_ARCH, a);
422 /* _FILENAME and _FLAGS are written at </package> */
424 const char *evrstr = id2str(pool, evr);
425 int buflen = strlen(name) + 1 + strlen(evrstr) + 1 + strlen(arch?arch:"") + 1;
427 if (!arch) arch = "";
428 buf = (char *)malloc(buflen);
430 sprintf(buf, "%s %s %s", name, evrstr, arch);
431 repodata_add_poolstr_array(pd->data, pd->datanum, UPDATE_COLLECTION, buf);
437 /* <filename>libntlm-0.4.2-1.fc8.x86_64.rpm</filename> */
438 /* <filename>libntlm-0.4.2-1.fc8.x86_64.rpm</filename> */
441 /* <reboot_suggested>True</reboot_suggested> */
444 /* <restart_suggested>True</restart_suggested> */
447 /* <relogin_suggested>True</relogin_suggested> */
451 split(NULL, NULL, 0); /* just to keep gcc happy about tools_util.h: static ... split() {...} Urgs!*/
461 endElement(void *userData, const char *name)
463 struct parsedata *pd = userData;
464 Pool *pool = pd->pool;
465 Solvable *s = pd->solvable;
466 Repo *repo = pd->repo;
469 fprintf(stderr, "end: %s\n", name);
471 if (pd->depth != pd->statedepth)
475 fprintf(stderr, "back from unknown %d %d %d\n", pd->state, pd->depth, pd->statedepth);
489 s->provides = repo_addid_dep(repo, s->provides, rel2id(pool, s->name, s->evr, REL_EQ, 1), 0);
494 s->name = str2id(pool, join2("patch", ":", pd->content), 1);
498 /* <title>imlib-1.9.15-6.fc8</title> */
501 while (pd->lcontent > 0
502 && *(pd->content + pd->lcontent - 1) == '\n')
505 *(pd->content + pd->lcontent) = 0;
507 repodata_set_str(pd->data, pd->datanum, SOLVABLE_SUMMARY, pd->content);
511 * <release>Fedora 8</release>
517 case STATE_REFERENCES:
519 case STATE_REFERENCE:
522 * <description>This update ...</description>
524 case STATE_DESCRIPTION:
526 repodata_set_str(pd->data, pd->datanum, SOLVABLE_DESCRIPTION, pd->content);
531 * <message>Warning! ...</message>
535 repodata_set_str(pd->data, pd->datanum, UPDATE_MESSAGE, pd->content);
540 case STATE_COLLECTION:
547 /* write _FILENAME and _FLAGS at </package>
548 * to ensure all UPDATE_COLLECTION_* arrays are filled in parallel
550 if (!package_filename_seen)
552 repodata_add_poolstr_array(pd->data, pd->datanum, UPDATE_COLLECTION_FILENAME, "");
554 repodata_add_idarray(pd->data, pd->datanum, UPDATE_COLLECTION_FLAGS, package_flags+1);
558 /* <filename>libntlm-0.4.2-1.fc8.x86_64.rpm</filename> */
559 /* <filename>libntlm-0.4.2-1.fc8.x86_64.rpm</filename> */
563 repodata_add_poolstr_array(pd->data, pd->datanum, UPDATE_COLLECTION_FILENAME, pd->content);
564 package_filename_seen = 1;
568 /* <reboot_suggested>True</reboot_suggested> */
572 && (pd->content[0] == 'T'
573 || pd->content[0] == 't'|| pd->content[0] == '1'))
575 /* FIXME: this is per-package, the global flag should be computed at runtime */
576 repodata_set_void(pd->data, pd->datanum, UPDATE_REBOOT);
581 /* <restart_suggested>True</restart_suggested> */
585 && (pd->content[0] == 'T'
586 || pd->content[0] == 't' || pd->content[0] == '1'))
588 /* FIXME: this is per-package, the global flag should be computed at runtime */
589 repodata_set_void(pd->data, pd->datanum, UPDATE_RESTART);
594 /* <relogin_suggested>True</relogin_suggested> */
598 && (pd->content[0] == 'T'
599 || pd->content[0] == 't' || pd->content[0] == '1'))
601 /* FIXME: this is per-package, the global flag should be computed at runtime */
602 repodata_set_void(pd->data, pd->datanum, UPDATE_RELOGIN);
611 pd->state = pd->sbtab[pd->state];
620 characterData(void *userData, const XML_Char *s, int len)
622 struct parsedata *pd = userData;
625 if (!pd->docontent) {
627 char *dup = strndup( s, len );
628 fprintf(stderr, "Content: [%d]'%s'\n", pd->state, dup );
633 l = pd->lcontent + len + 1;
634 if (l > pd->acontent)
636 pd->content = realloc(pd->content, l + 256);
637 pd->acontent = l + 256;
639 c = pd->content + pd->lcontent;
647 #define BUFF_SIZE 8192
650 repo_add_updateinfoxml(Repo *repo, FILE *fp, int flags)
652 Pool *pool = repo->pool;
656 struct stateswitch *sw;
658 memset(&pd, 0, sizeof(pd));
659 for (i = 0, sw = stateswitches; sw->from != NUMSTATES; i++, sw++)
661 if (!pd.swtab[sw->from])
662 pd.swtab[sw->from] = sw;
663 pd.sbtab[sw->to] = sw->from;
667 pd.data = repo_add_repodata(pd.repo, 0);
669 pd.content = malloc(256);
672 pd.tempstr = malloc(256);
675 XML_Parser parser = XML_ParserCreate(NULL);
676 XML_SetUserData(parser, &pd);
677 XML_SetElementHandler(parser, startElement, endElement);
678 XML_SetCharacterDataHandler(parser, characterData);
681 l = fread(buf, 1, sizeof(buf), fp);
682 if (XML_Parse(parser, buf, l, l == 0) == XML_STATUS_ERROR)
684 fprintf(stderr, "repo_updateinfoxml: %s at line %u:%u\n", XML_ErrorString(XML_GetErrorCode(parser)), (unsigned int)XML_GetCurrentLineNumber(parser), (unsigned int)XML_GetCurrentColumnNumber(parser));
690 XML_ParserFree(parser);
693 repodata_internalize(pd.data);