- fix: region trailer offset sanity check wrong (#71996).

CVS patchset: 5654
CVS date: 2002/08/22 00:37:21

diff --git a/CHANGES b/CHANGES
index d06909fa1eb1ca3538a9f34fb82a1599361d6d7d..78077dcd7e73e2f2833ee846e3787761498ac317 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -257,6 +257,7 @@
        - fix: add epoch to "already installed" check.
        - check for interrupt during iteration.
        - python: add ts.setProbFilter() method, remove ts.run() argument.
+       - fix: region trailer offset sanity check wrong (#71996).
 
 4.0.3 -> 4.0.4:
        - solaris: translate i86pc to i386 (#57182).

diff --git a/lib/package.c b/lib/package.c
index 8bbecfb5055f4eb712c64a3615d3265fa255c064..923e3deb2c809649c4567628157ba56b12f42330 100644 (file)
--- a/lib/package.c
+++ b/lib/package.c
@@ -268,9 +268,15 @@ static int headerVerifyInfo(int il, int dl, entryInfo pe, entryInfo info,
            info->offset = -info->offset;
        info->count = ntohl(pe[i].count);
 
-       if (hdrchkType(info->type) || hdrchkAlign(info->type, info->offset) ||
-               hdrchkRange(dl, info->offset) || hdrchkData(info->count))
+       if (hdrchkType(info->type))
            return i;
+       if (hdrchkAlign(info->type, info->offset))
+           return i;
+       if (!negate && hdrchkRange(dl, info->offset))
+           return i;
+       if (hdrchkData(info->count))
+           return i;
+
     }
 /*@=boundsread@*/
     return -1;
@@ -318,13 +324,23 @@ rpmRC headerCheck(rpmts ts, const void * uh, size_t uc, const char ** msg)
     int xx;
     int i;
 
+    buf[0] = '\0';
+
     /* Is the blob the right size? */
-    if (uc > 0 && pvlen != uc)
+    if (uc > 0 && pvlen != uc) {
+       sprintf(buf, _("blob size(%d): BAD, 8 + 16 * il(%d) + dl(%d)\n"),
+                       uc, il, dl);
        goto exit;
+    }
 
     /* Check (and convert) the 1st tag element. */
-    if (headerVerifyInfo(1, dl, pe, &entry->info, 0) != -1)
+    xx = headerVerifyInfo(1, dl, pe, &entry->info, 0);
+    if (xx != -1) {
+       sprintf(buf, _("tag[%d]: BAD, tag %d type %d offset %d count %d\n"),
+               0, entry->info.tag, entry->info.type,
+               entry->info.offset, entry->info.count);
        goto exit;
+    }
 
     /* Is there an immutable header region tag? */
 /*@-sizeoftype@*/
@@ -345,11 +361,18 @@ rpmRC headerCheck(rpmts ts, const void * uh, size_t uc, const char ** msg)
     end += entry->info.count;
 
 /*@-sizeoftype@*/
-    if (headerVerifyInfo(1, dl, info, &entry->info, 1) != -1
-     || !(entry->info.tag == RPMTAG_HEADERIMMUTABLE
+    xx = headerVerifyInfo(1, dl, info, &entry->info, 1);
+    if (xx != -1 ||
+       !(entry->info.tag == RPMTAG_HEADERIMMUTABLE
        && entry->info.type == RPM_BIN_TYPE
        && entry->info.count == REGION_TAG_COUNT))
+    {
+       sprintf(buf,
+               _("region trailer: BAD, tag %d type %d offset %d count %d\n"),
+               entry->info.tag, entry->info.type,
+               entry->info.offset, entry->info.count);
        goto exit;
+    }
 /*@=sizeoftype@*/
 /*@-boundswrite@*/
     memset(info, 0, sizeof(*info));
@@ -357,13 +380,20 @@ rpmRC headerCheck(rpmts ts, const void * uh, size_t uc, const char ** msg)
 
     /* Is the no. of tags in the region less than the total no. of tags? */
     ril = entry->info.offset/sizeof(*pe);
-    if (ril > il)
+    if (ril > il) {
+       sprintf(buf, _("region size: BAD, ril(%d) > il(%d)\n"), ril, il);
        goto exit;
+    }
 
     /* Find a header-only digest/signature tag. */
     for (i = ril; i < il; i++) {
-       if (headerVerifyInfo(1, dl, pe+i, &entry->info, 0) != -1)
+       xx = headerVerifyInfo(1, dl, pe+i, &entry->info, 0);
+       if (xx != -1) {
+           sprintf(buf, _("tag[%d]: BAD, tag %d type %d offset %d count %d\n"),
+               i, entry->info.tag, entry->info.type,
+               entry->info.offset, entry->info.count);
            goto exit;
+       }
 
        switch (entry->info.tag) {
        case RPMTAG_SHA1HEADER:
@@ -407,16 +437,25 @@ rpmRC headerCheck(rpmts ts, const void * uh, size_t uc, const char ** msg)
 
 exit:
     /* Return determined RPMRC_OK/RPMRC_FAIL conditions. */
-    if (rc != RPMRC_NOTFOUND)
+    if (rc != RPMRC_NOTFOUND) {
+       if (msg) *msg = xstrdup(buf);
        return rc;
+    }
 
     /* If no header-only digest/signature, then do simple sanity check. */
     if (info->tag == 0) {
 verifyinfo_exit:
-       if (headerVerifyInfo(ril-1, dl, pe+1, &entry->info, 0) != -1)
+       xx = headerVerifyInfo(ril-1, dl, pe+1, &entry->info, 0);
+       if (xx != -1) {
+           sprintf(buf, _("tag[%d]: BAD, tag %d type %d offset %d count %d\n"),
+               xx+1, entry->info.tag, entry->info.type,
+               entry->info.offset, entry->info.count);
            rc = RPMRC_FAIL;
-       else
+       } else {
+           sprintf(buf, "Header sanity check: OK\n");
            rc = RPMRC_OK;
+       }
+       if (msg) *msg = xstrdup(buf);
        return rc;
     }
 

diff --git a/rpm.spec.in b/rpm.spec.in
index 4f6272e71a5b357a788cb48bd3210bf3efeb68e8..c9a67912da418588aca7b423ff9212597ba2c280 100644 (file)
--- a/rpm.spec.in
+++ b/rpm.spec.in
@@ -17,7 +17,7 @@ Name: rpm
 %define version @VERSION@
 Version: %{version}
 %{expand: %%define rpm_version %{version}}
-Release: 0.85
+Release: 0.86
 Group: System Environment/Base
 Source: ftp://ftp.rpm.org/pub/rpm/dist/rpm-4.0.x/rpm-%{rpm_version}.tar.gz
 Copyright: GPL
@@ -519,6 +519,9 @@ fi
 %{__prefix}/include/popt.h
 
 %changelog
+* Wed Aug 21 2002 Jeff Johnson <jbj@redhat.com>
+- fix: region trailer offset sanity check wrong (#71996).
+
 * Tue Aug 20 2002 Jeff Johnson <jbj@redhat.com> 4.1-0.85
 - python: stupid typo broke ts.check().
 - fix: add epoch to "already installed" check.

diff --git a/rpmdb/rpmdb.c b/rpmdb/rpmdb.c
index 7af2fc6133918e2466961e9db567c890e9a0643f..37b8187471f30bbe49c07a291fc528f6f6feb083 100644 (file)
--- a/rpmdb/rpmdb.c
+++ b/rpmdb/rpmdb.c
@@ -1636,7 +1636,7 @@ static int miFreeHeader(rpmdbMatchIterator mi, dbiIndex dbi)
            rpmrc = (*mi->mi_hdrchk) (mi->mi_ts, data->data, data->size, &msg);
            lvl = (rpmrc == RPMRC_FAIL ? RPMMESS_ERROR : RPMMESS_DEBUG);
            rpmMessage(lvl, "%s h#%8u %s",
-               (rpmrc == RPMRC_FAIL ? _("rpmdb: skipping") : "write"),
+               (rpmrc == RPMRC_FAIL ? _("miFreeHeader: skipping") : "write"),
                        mi->mi_prevoffset, (msg ? msg : "\n"));
            msg = _free(msg);
        }
@@ -2268,7 +2268,7 @@ top:
            rpmrc = (*mi->mi_hdrchk) (mi->mi_ts, uh, uhlen, &msg);
            lvl = (rpmrc == RPMRC_FAIL ? RPMMESS_ERROR : RPMMESS_DEBUG);
            rpmMessage(lvl, "%s h#%8u %s",
-               (rpmrc == RPMRC_FAIL ? _("rpmdb: skipping") : " read"),
+               (rpmrc == RPMRC_FAIL ? _("rpmdbNextIterator: skipping") : " read"),
                        mi->mi_offset, (msg ? msg : "\n"));
            msg = _free(msg);
 
@@ -3018,7 +3018,7 @@ data->size = headerSizeof(h, HEADER_MAGIC_NO);
                    rpmrc = (*hdrchk) (ts, data->data, data->size, &msg);
                    lvl = (rpmrc == RPMRC_FAIL ? RPMMESS_ERROR : RPMMESS_DEBUG);
                    rpmMessage(lvl, "%s h#%8u %s",
-                       (rpmrc == RPMRC_FAIL ? _("rpmdb: skipping") : "  +++"),
+                       (rpmrc == RPMRC_FAIL ? _("rpmdbAdd: skipping") : "  +++"),
                                hdrNum, (msg ? msg : "\n"));
                    msg = _free(msg);
                }