From: Michael Schroeder <mls@suse.de>
Date: Wed, 4 Apr 2012 12:25:16 +0000 (+0200)
Subject: - make example solv program a tiny bit more secure (shouldn't use system() at all)
X-Git-Tag: BASE-SuSE-Code-12_2-Branch~50
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=040f122b7f1deba82ed856a50295569a5aa97f71;hp=b69427b44ecaf2f103a9fbd452e4411c891f495f;p=platform%2Fupstream%2Flibsolv.git

- make example solv program a tiny bit more secure (shouldn't use system() at all)
---

diff --git a/examples/solv.c b/examples/solv.c
index d9e33d8..ce976e4 100644
--- a/examples/solv.c
+++ b/examples/solv.c
@@ -3233,21 +3233,28 @@ rerunsolver:
 		      const char *seqnum;
 		      const char *seq;
 		      const char *dloc;
+		      const char *archstr;
 		      FILE *fp;
 		      char cmd[128];
 		      int newfd;
 
+		      archstr = pool_id2str(pool, s->arch);
+		      if (strlen(archstr) > 10 || strchr(archstr, '\'') != 0)
+			continue;
+
 		      seqname = pool_lookup_str(pool, SOLVID_POS, DELTA_SEQ_NAME);
 		      seqevr = pool_lookup_str(pool, SOLVID_POS, DELTA_SEQ_EVR);
 		      seqnum = pool_lookup_str(pool, SOLVID_POS, DELTA_SEQ_NUM);
 		      seq = pool_tmpjoin(pool, seqname, "-", seqevr);
 		      seq = pool_tmpappend(pool, seq, "-", seqnum);
+		      if (strchr(seq, '\'') != 0)
+			continue;
 #ifdef FEDORA
-		      sprintf(cmd, "/usr/bin/applydeltarpm -a %s -c -s ", pool_id2str(pool, s->arch));
+		      sprintf(cmd, "/usr/bin/applydeltarpm -a '%s' -c -s '", archstr);
 #else
-		      sprintf(cmd, "/usr/bin/applydeltarpm -c -s ");
+		      sprintf(cmd, "/usr/bin/applydeltarpm -c -s '");
 #endif
-		      if (system(pool_tmpjoin(pool, cmd, seq, 0)) != 0)
+		      if (system(pool_tmpjoin(pool, cmd, seq, "'")) != 0)
 			continue;	/* didn't match */
 		      /* looks good, download delta */
 		      chksumtype = 0;
@@ -3263,7 +3270,7 @@ rerunsolver:
 		      /* got it, now reconstruct */
 		      newfd = opentmpfile();
 #ifdef FEDORA
-		      sprintf(cmd, "applydeltarpm -a %s /dev/fd/%d /dev/fd/%d", pool_id2str(pool, s->arch), fileno(fp), newfd);
+		      sprintf(cmd, "applydeltarpm -a '%s' /dev/fd/%d /dev/fd/%d", archstr, fileno(fp), newfd);
 #else
 		      sprintf(cmd, "applydeltarpm /dev/fd/%d /dev/fd/%d", fileno(fp), newfd);
 #endif
diff --git a/src/pool.c b/src/pool.c
index 92238d5..7b9210e 100644
--- a/src/pool.c
+++ b/src/pool.c
@@ -131,11 +131,11 @@ pool_setdisttype(Pool *pool, int disttype)
 {
   pool->disttype = disttype;
   if (disttype == DISTTYPE_RPM)
-    pool->noarchid == ARCH_NOARCH;
+    pool->noarchid = ARCH_NOARCH;
   if (disttype == DISTTYPE_DEB)
-    pool->noarchid == ARCH_ALL;
+    pool->noarchid = ARCH_ALL;
   if (disttype == DISTTYPE_ARCH)
-    pool->noarchid == ARCH_ANY;
+    pool->noarchid = ARCH_ANY;
   pool->solvables[SYSTEMSOLVABLE].arch = pool->noarchid;
 }
 #endif