fix: prevent segfault if malicious server sends 1 GB of data through ftpNLST.

[platform/upstream/rpm.git] / lib / transaction.c

diff --git a/lib/transaction.c b/lib/transaction.c
index a465494..d019de4 100644 (file)
--- a/lib/transaction.c
+++ b/lib/transaction.c
@@ -30,11 +30,9 @@
 
 #include "debug.h"
 
-/*@access FD_t @*/             /* XXX compared with NULL */
-/*@access Header @*/           /* XXX compared with NULL */
+/*@access Header @*/           /* XXX ts->notify arg1 is void ptr */
 /*@access rpmps @*/    /* XXX need rpmProblemSetOK() */
 /*@access dbiIndexSet @*/
-/*@access rpmdb @*/
 
 /*@access rpmpsm @*/
 
@@ -238,9 +236,6 @@ static int handleInstInstalledFiles(const rpmts ts,
        mi = rpmdbFreeIterator(mi);
     }
 
-    if (otherFi == NULL)
-       return 1;
-
     /* Compute package color. */
     tecolor = rpmteColor(p);
     tecolor &= tscolor;
@@ -253,6 +248,9 @@ static int handleInstInstalledFiles(const rpmts ts,
        otecolor |= rpmfiFColor(otherFi);
     otecolor &= tscolor;
 
+    if (otherFi == NULL)
+       return 1;
+
     fi->replaced = xcalloc(sharedCount, sizeof(*fi->replaced));
 
     ps = rpmtsProblems(ts);
@@ -866,7 +864,7 @@ static void skipFiles(const rpmts ts, rpmfi fi)
        /*
         * Skip i18n language specific files.
         */
-       if (fi->flangs && languages && *fi->flangs[i]) {
+       if (languages != NULL && fi->flangs != NULL && *fi->flangs[i]) {
            const char **lang, *l, *le;
            for (lang = languages; *lang != NULL; lang++) {
                if (!strcmp(*lang, "all"))
@@ -959,11 +957,13 @@ static void skipFiles(const rpmts ts, rpmfi fi)
        }
     }
 
+/*@-dependenttrans@*/
     if (netsharedPaths) freeSplitString(netsharedPaths);
 #ifdef DYING   /* XXX freeFi will deal with this later. */
     fi->flangs = _free(fi->flangs);
 #endif
     if (languages) freeSplitString((char **)languages);
+/*@=dependenttrans@*/
 }
 /*@=bounds@*/
 /*@=mustmod@*/
@@ -1025,7 +1025,6 @@ int rpmtsRun(rpmts ts, rpmps okProbs, rpmprobFilterFlags ignoreSet)
     if (rpmtsFlags(ts) & RPMTRANS_FLAG_NOTRIGGERS)
        (void) rpmtsSetFlags(ts, (rpmtsFlags(ts) | _noTransTriggers));
 
-    /* XXX MULTILIB is broken, as packages can and do execute /sbin/ldconfig. */
     if (rpmtsFlags(ts) & RPMTRANS_FLAG_JUSTDB)
        (void) rpmtsSetFlags(ts, (rpmtsFlags(ts) | _noTransScripts | _noTransTriggers));
 
@@ -1154,6 +1153,7 @@ rpmMessage(RPMMESS_DEBUG, _("sanity checking %d elements\n"), rpmtsNElements(ts)
      * worth the trouble though.
      */
 rpmMessage(RPMMESS_DEBUG, _("computing %d file fingerprints\n"), totalFileCount);
+
     numAdded = numRemoved = 0;
     pi = rpmtsiInit(ts);
     while ((p = rpmtsiNext(pi, 0)) != NULL) {
@@ -1209,6 +1209,7 @@ rpmMessage(RPMMESS_DEBUG, _("computing %d file fingerprints\n"), totalFileCount)
            continue;   /* XXX can't happen */
        fc = rpmfiFC(fi);
 
+       (void) rpmswEnter(rpmtsOp(ts, RPMTS_OP_FINGERPRINT), 0);
        fpLookupList(fpc, fi->dnl, fi->bnl, fi->dil, fc, fi->fps);
        /*@-branchstate@*/
        fi = rpmfiInit(fi, 0);
@@ -1221,6 +1222,8 @@ rpmMessage(RPMMESS_DEBUG, _("computing %d file fingerprints\n"), totalFileCount)
            /*@=dependenttrans@*/
        }
        /*@=branchstate@*/
+       (void) rpmswExit(rpmtsOp(ts, RPMTS_OP_FINGERPRINT), fc);
+
     }
     pi = rpmtsiFree(pi);
 
@@ -1249,6 +1252,7 @@ rpmMessage(RPMMESS_DEBUG, _("computing file dispositions\n"));
 
        if (fc == 0) continue;
 
+       (void) rpmswEnter(rpmtsOp(ts, RPMTS_OP_FINGERPRINT), 0);
        /* Extract file info for all files in this package from the database. */
        matches = xcalloc(fc, sizeof(*matches));
        if (rpmdbFindFpList(rpmtsGetRdb(ts), fi->fps, matches, fc)) {
@@ -1348,6 +1352,7 @@ rpmMessage(RPMMESS_DEBUG, _("computing file dispositions\n"));
        case TR_REMOVED:
            /*@switchbreak@*/ break;
        }
+       (void) rpmswExit(rpmtsOp(ts, RPMTS_OP_FINGERPRINT), fc);
     }
     pi = rpmtsiFree(pi);
     ps = rpmpsFree(ps);
@@ -1397,6 +1402,7 @@ rpmMessage(RPMMESS_DEBUG, _("computing file dispositions\n"));
      */
     if (rpmtsFlags(ts) & (RPMTRANS_FLAG_DIRSTASH | RPMTRANS_FLAG_REPACKAGE)) {
        int progress;
+
        progress = 0;
        pi = rpmtsiInit(ts);
        while ((p = rpmtsiNext(pi, 0)) != NULL) {
@@ -1419,6 +1425,8 @@ rpmMessage(RPMMESS_DEBUG, _("computing file dispositions\n"));
                        numRemoved, NULL, ts->notifyData));
                progress++;
 
+               (void) rpmswEnter(rpmtsOp(ts, RPMTS_OP_REPACKAGE), 0);
+
        /* XXX TR_REMOVED needs CPIO_MAP_{ABSOLUTE,ADDDOT} CPIO_ALL_HARDLINKS */
                fi->mapflags |= CPIO_MAP_ABSOLUTE;
                fi->mapflags |= CPIO_MAP_ADDDOT;
@@ -1430,6 +1438,8 @@ rpmMessage(RPMMESS_DEBUG, _("computing file dispositions\n"));
                fi->mapflags &= ~CPIO_MAP_ADDDOT;
                fi->mapflags &= ~CPIO_ALL_HARDLINKS;
 
+               (void) rpmswExit(rpmtsOp(ts, RPMTS_OP_REPACKAGE), 0);
+
                /*@switchbreak@*/ break;
            }
        }
@@ -1457,11 +1467,13 @@ rpmMessage(RPMMESS_DEBUG, _("computing file dispositions\n"));
            continue;   /* XXX can't happen */
        
        psm = rpmpsmNew(ts, p, fi);
+assert(psm != NULL);
        psm->unorderedSuccessor =
                (rpmtsiOc(pi) >= rpmtsUnorderedSuccessors(ts, -1) ? 1 : 0);
 
        switch (rpmteType(p)) {
        case TR_ADDED:
+           (void) rpmswEnter(rpmtsOp(ts, RPMTS_OP_INSTALL), 0);
 
            pkgKey = rpmteAddedKey(p);
 
@@ -1516,7 +1528,9 @@ rpmMessage(RPMMESS_DEBUG, _("computing file dispositions\n"));
 
                    fi->fstates = NULL;
                    fi->actions = NULL;
+/*@-nullstate@*/ /* FIX: fi->actions is NULL */
                    fi = rpmfiFree(fi);
+/*@=nullstate@*/
 
                    savep = rpmtsSetRelocateElement(ts, p);
                    fi = rpmfiNew(ts, p->h, RPMTAG_BASENAMES, 1);
@@ -1556,8 +1570,13 @@ rpmMessage(RPMMESS_DEBUG, _("computing file dispositions\n"));
 
            p->h = headerFree(p->h);
 
+           (void) rpmswExit(rpmtsOp(ts, RPMTS_OP_INSTALL), 0);
+
            /*@switchbreak@*/ break;
+
        case TR_REMOVED:
+           (void) rpmswEnter(rpmtsOp(ts, RPMTS_OP_ERASE), 0);
+
            rpmMessage(RPMMESS_DEBUG, "========== --- %s\n", rpmteNEVR(p));
            /*
             * XXX This has always been a hack, now mostly broken.
@@ -1567,6 +1586,9 @@ rpmMessage(RPMMESS_DEBUG, _("computing file dispositions\n"));
                if (rpmpsmStage(psm, PSM_PKGERASE))
                    ourrc++;
            }
+
+           (void) rpmswExit(rpmtsOp(ts, RPMTS_OP_ERASE), 0);
+
            /*@switchbreak@*/ break;
        }
        xx = rpmdbSync(rpmtsGetRdb(ts));