2 * Copyright (c) 2007, Novell Inc.
4 * This program is licensed under the BSD license, read LICENSE.BSD
5 * for further information
9 #define _XOPEN_SOURCE /* glibc2 needs this */
10 #include <sys/types.h>
18 #include "solv_xmlparser.h"
19 #include "repo_updateinfoxml.h"
21 #include "tools_util.h"
25 * <update from="rel-eng@fedoraproject.org" status="stable" type="security" version="1.4">
26 * <id>FEDORA-2007-4594</id>
27 * <title>imlib-1.9.15-6.fc8</title>
28 * <severity>Important</severity>
29 * <release>Fedora 8</release>
30 * <rights>Copyright 2007 Company Inc</rights>
31 * <issued date="2007-12-28 16:42:30"/>
32 * <updated date="2008-03-14 12:00:00"/>
34 * <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=426091" id="426091" title="CVE-2007-3568 imlib: infinite loop DoS using crafted BMP image" type="bugzilla"/>
36 * <description>This update includes a fix for a denial-of-service issue (CVE-2007-3568) whereby an attacker who could get an imlib-using user to view a specially-crafted BMP image could cause the user's CPU to go into an infinite loop.</description>
38 * <collection short="F8">
39 * <name>Fedora 8</name>
40 * <module name="pki-deps" stream="10.6" version="20181019123559" context="9edba152" arch="x86_64"/>
41 * <package arch="ppc64" name="imlib-debuginfo" release="6.fc8" src="http://download.fedoraproject.org/pub/fedora/linux/updates/8/ppc64/imlib-debuginfo-1.9.15-6.fc8.ppc64.rpm" version="1.9.15">
42 * <filename>imlib-debuginfo-1.9.15-6.fc8.ppc64.rpm</filename>
43 * <reboot_suggested>True</reboot_suggested>
78 static struct solv_xmlparser_element stateswitches[] = {
79 { STATE_START, "updates", STATE_UPDATES, 0 },
80 { STATE_START, "update", STATE_UPDATE, 0 },
81 { STATE_UPDATES, "update", STATE_UPDATE, 0 },
82 { STATE_UPDATE, "id", STATE_ID, 1 },
83 { STATE_UPDATE, "title", STATE_TITLE, 1 },
84 { STATE_UPDATE, "severity", STATE_SEVERITY, 1 },
85 { STATE_UPDATE, "rights", STATE_RIGHTS, 1 },
86 { STATE_UPDATE, "release", STATE_RELEASE, 1 },
87 { STATE_UPDATE, "issued", STATE_ISSUED, 0 },
88 { STATE_UPDATE, "updated", STATE_UPDATED, 0 },
89 { STATE_UPDATE, "description", STATE_DESCRIPTION, 1 },
90 { STATE_UPDATE, "message", STATE_MESSAGE , 1 },
91 { STATE_UPDATE, "references", STATE_REFERENCES, 0 },
92 { STATE_UPDATE, "pkglist", STATE_PKGLIST, 0 },
93 { STATE_REFERENCES, "reference", STATE_REFERENCE, 0 },
94 { STATE_PKGLIST, "collection", STATE_COLLECTION, 0 },
95 { STATE_COLLECTION, "name", STATE_NAME, 1 },
96 { STATE_COLLECTION, "package", STATE_PACKAGE, 0 },
97 { STATE_COLLECTION, "module", STATE_MODULE, 0 },
98 { STATE_PACKAGE, "filename", STATE_FILENAME, 1 },
99 { STATE_PACKAGE, "reboot_suggested",STATE_REBOOT, 1 },
100 { STATE_PACKAGE, "restart_suggested",STATE_RESTART, 1 },
101 { STATE_PACKAGE, "relogin_suggested",STATE_RELOGIN, 1 },
114 struct solv_xmlparser xmlp;
119 * Convert date strings ("1287746075" or "2010-10-22 13:14:35")
123 datestr2timestamp(const char *date)
130 for (p = date; *p >= '0' && *p <= '9'; p++)
134 memset(&tm, 0, sizeof(tm));
135 if (!strptime(date, "%F%T", &tm))
141 * create evr (as Id) from 'epoch', 'version' and 'release' attributes
144 makeevr_atts(Pool *pool, struct parsedata *pd, const char **atts)
146 const char *e, *v, *r, *v2;
151 for (; *atts; atts += 2)
153 if (!strcmp(*atts, "epoch"))
155 else if (!strcmp(*atts, "version"))
157 else if (!strcmp(*atts, "release"))
160 if (e && (!*e || !strcmp(e, "0")))
164 for (v2 = v; *v2 >= '0' && *v2 <= '9'; v2++)
166 if (v2 > v && *v2 == ':')
177 c = space = solv_xmlparser_contentspace(&pd->xmlp, l);
199 fprintf(stderr, "evr: %s\n", space);
201 return pool_str2id(pool, space, 1);
207 startElement(struct solv_xmlparser *xmlp, int state, const char *name, const char **atts)
209 struct parsedata *pd = xmlp->userdata;
210 Pool *pool = pd->pool;
211 Solvable *solvable = pd->solvable;
216 * <update from="rel-eng@fedoraproject.org"
218 * type="bugfix" (enhancement, security)
223 const char *from = 0, *type = 0, *version = 0;
224 for (; *atts; atts += 2)
226 if (!strcmp(*atts, "from"))
228 else if (!strcmp(*atts, "type"))
230 else if (!strcmp(*atts, "version"))
233 solvable = pd->solvable = pool_id2solvable(pool, repo_add_solvable(pd->repo));
234 pd->handle = pd->solvable - pool->solvables;
236 solvable->vendor = pool_str2id(pool, from, 1);
237 solvable->evr = pool_str2id(pool, version, 1);
238 solvable->arch = ARCH_NOARCH;
240 repodata_set_str(pd->data, pd->handle, SOLVABLE_PATCHCATEGORY, type);
241 pd->buildtime = (time_t)0;
248 const char *date = solv_xmlparser_find_attr("date", atts);
251 time_t t = datestr2timestamp(date);
252 if (t && t > pd->buildtime)
258 case STATE_REFERENCE:
260 const char *href = 0, *id = 0, *title = 0, *type = 0;
262 for (; *atts; atts += 2)
264 if (!strcmp(*atts, "href"))
266 else if (!strcmp(*atts, "id"))
268 else if (!strcmp(*atts, "title"))
270 else if (!strcmp(*atts, "type"))
273 refhandle = repodata_new_handle(pd->data);
275 repodata_set_str(pd->data, refhandle, UPDATE_REFERENCE_HREF, href);
277 repodata_set_str(pd->data, refhandle, UPDATE_REFERENCE_ID, id);
279 repodata_set_str(pd->data, refhandle, UPDATE_REFERENCE_TITLE, title);
281 repodata_set_poolstr(pd->data, refhandle, UPDATE_REFERENCE_TYPE, type);
282 repodata_add_flexarray(pd->data, pd->handle, UPDATE_REFERENCE, refhandle);
286 /* <package arch="ppc64" name="imlib-debuginfo" release="6.fc8"
287 * src="http://download.fedoraproject.org/pub/fedora/linux/updates/8/ppc64/imlib-debuginfo-1.9.15-6.fc8.ppc64.rpm"
291 * -> patch.conflicts: {name} < {version}.{release}
295 const char *arch = 0, *name = 0;
296 Id evr = makeevr_atts(pool, pd, atts); /* parse "epoch", "version", "release" */
300 for (; *atts; atts += 2)
302 if (!strcmp(*atts, "arch"))
304 else if (!strcmp(*atts, "name"))
307 /* generated Id for name */
308 n = pool_str2id(pool, name, 1);
312 /* generate Id for arch and combine with name */
313 a = pool_str2id(pool, arch, 1);
314 rel_id = pool_rel2id(pool, n, a, REL_ARCH, 1);
316 rel_id = pool_rel2id(pool, rel_id, evr, REL_LT, 1);
317 solvable->conflicts = repo_addid_dep(pd->repo, solvable->conflicts, rel_id, 0);
319 /* who needs the collection anyway? */
320 pd->collhandle = repodata_new_handle(pd->data);
321 repodata_set_id(pd->data, pd->collhandle, UPDATE_COLLECTION_NAME, n);
322 repodata_set_id(pd->data, pd->collhandle, UPDATE_COLLECTION_EVR, evr);
324 repodata_set_id(pd->data, pd->collhandle, UPDATE_COLLECTION_ARCH, a);
329 const char *name = 0, *stream = 0, *version = 0, *context = 0, *arch = 0;
332 for (; *atts; atts += 2)
334 if (!strcmp(*atts, "arch"))
336 else if (!strcmp(*atts, "name"))
338 else if (!strcmp(*atts, "stream"))
340 else if (!strcmp(*atts, "version"))
342 else if (!strcmp(*atts, "context"))
345 module_handle = repodata_new_handle(pd->data);
347 repodata_set_poolstr(pd->data, module_handle, UPDATE_MODULE_NAME, name);
349 repodata_set_poolstr(pd->data, module_handle, UPDATE_MODULE_STREAM, stream);
351 repodata_set_poolstr(pd->data, module_handle, UPDATE_MODULE_VERSION, version);
353 repodata_set_poolstr(pd->data, module_handle, UPDATE_MODULE_CONTEXT, context);
355 repodata_set_poolstr(pd->data, module_handle, UPDATE_MODULE_ARCH, arch);
356 repodata_add_flexarray(pd->data, pd->handle, UPDATE_MODULE, module_handle);
368 endElement(struct solv_xmlparser *xmlp, int state, char *content)
370 struct parsedata *pd = xmlp->userdata;
371 Pool *pool = pd->pool;
372 Solvable *s = pd->solvable;
373 Repo *repo = pd->repo;
378 s->provides = repo_addid_dep(repo, s->provides, pool_rel2id(pool, s->name, s->evr, REL_EQ, 1), 0);
381 repodata_set_num(pd->data, pd->handle, SOLVABLE_BUILDTIME, pd->buildtime);
382 pd->buildtime = (time_t)0;
387 s->name = pool_str2id(pool, join2(&pd->jd, "patch", ":", content), 1);
390 /* <title>imlib-1.9.15-6.fc8</title> */
392 /* strip trailing newlines */
393 while (pd->xmlp.lcontent > 0 && content[pd->xmlp.lcontent - 1] == '\n')
394 content[--pd->xmlp.lcontent] = 0;
395 repodata_set_str(pd->data, pd->handle, SOLVABLE_SUMMARY, content);
399 repodata_set_poolstr(pd->data, pd->handle, UPDATE_SEVERITY, content);
403 repodata_set_poolstr(pd->data, pd->handle, UPDATE_RIGHTS, content);
407 * <description>This update ...</description>
409 case STATE_DESCRIPTION:
410 repodata_set_str(pd->data, pd->handle, SOLVABLE_DESCRIPTION, content);
414 * <message>Warning! ...</message>
417 repodata_set_str(pd->data, pd->handle, UPDATE_MESSAGE, content);
421 repodata_add_flexarray(pd->data, pd->handle, UPDATE_COLLECTION, pd->collhandle);
425 /* <filename>libntlm-0.4.2-1.fc8.x86_64.rpm</filename> */
426 /* <filename>libntlm-0.4.2-1.fc8.x86_64.rpm</filename> */
428 repodata_set_str(pd->data, pd->collhandle, UPDATE_COLLECTION_FILENAME, content);
431 /* <reboot_suggested>True</reboot_suggested> */
433 if (content[0] == 'T' || content[0] == 't'|| content[0] == '1')
435 /* FIXME: this is per-package, the global flag should be computed at runtime */
436 repodata_set_void(pd->data, pd->handle, UPDATE_REBOOT);
437 repodata_set_void(pd->data, pd->collhandle, UPDATE_REBOOT);
441 /* <restart_suggested>True</restart_suggested> */
443 if (content[0] == 'T' || content[0] == 't'|| content[0] == '1')
445 /* FIXME: this is per-package, the global flag should be computed at runtime */
446 repodata_set_void(pd->data, pd->handle, UPDATE_RESTART);
447 repodata_set_void(pd->data, pd->collhandle, UPDATE_RESTART);
451 /* <relogin_suggested>True</relogin_suggested> */
453 if (content[0] == 'T' || content[0] == 't'|| content[0] == '1')
455 /* FIXME: this is per-package, the global flag should be computed at runtime */
456 repodata_set_void(pd->data, pd->handle, UPDATE_RELOGIN);
457 repodata_set_void(pd->data, pd->collhandle, UPDATE_RELOGIN);
466 repo_add_updateinfoxml(Repo *repo, FILE *fp, int flags)
468 Pool *pool = repo->pool;
472 data = repo_add_repodata(repo, flags);
474 memset(&pd, 0, sizeof(pd));
478 solv_xmlparser_init(&pd.xmlp, stateswitches, &pd, startElement, endElement);
479 if (solv_xmlparser_parse(&pd.xmlp, fp) != SOLV_XMLPARSER_OK)
480 pd.ret = pool_error(pool, -1, "repo_updateinfoxml: %s at line %u:%u", pd.xmlp.errstr, pd.xmlp.line, pd.xmlp.column);
481 solv_xmlparser_free(&pd.xmlp);
482 join_freemem(&pd.jd);
484 if (!(flags & REPO_NO_INTERNALIZE))
485 repodata_internalize(data);