Imported Upstream version 0.6.24upstream/0.6.24

Change-Id: I68f4d40b704c1ccd2a86576a3c03687922f023aa
Signed-off-by: DongHun Kwak <dh0128.kwak@samsung.com>

5 files changed, 238 insertions, 171 deletions

diff --git a/ext/CMakeLists.txt b/ext/CMakeLists.txt
index ec5f20c..586eda8 100644
--- a/ext/CMakeLists.txt
+++ b/ext/CMakeLists.txt
@@ -4,12 +4,12 @@ SET (libsolvext_SRCS
 SET (libsolvext_HEADERS
     tools_util.h solv_xfopen.h testcase.h)
 
-IF (ENABLE_RPMDB)
+IF (ENABLE_RPMDB OR ENABLE_RPMPKG)
     SET (libsolvext_SRCS ${libsolvext_SRCS}
         pool_fileconflicts.c repo_rpmdb.c)
     SET (libsolvext_HEADERS ${libsolvext_HEADERS}
         pool_fileconflicts.h repo_rpmdb.h)
-ENDIF (ENABLE_RPMDB)
+ENDIF (ENABLE_RPMDB OR ENABLE_RPMPKG)
 
 IF (ENABLE_PUBKEY)
     SET (libsolvext_SRCS ${libsolvext_SRCS}
@@ -45,12 +45,12 @@ ENDIF (ENABLE_SUSEREPO)
 
 # old cmake does not support parenthetical expressions...
 IF (ENABLE_COMPLEX_DEPS)
-IF (ENABLE_SUSEREPO OR ENABLE_RPMMD OR ENABLE_RPMDB)
+IF (ENABLE_SUSEREPO OR ENABLE_RPMMD OR ENABLE_RPMDB OR ENABLE_RPMPKG)
     SET (libsolvext_SRCS ${libsolvext_SRCS}
 	pool_parserpmrichdep.c)
     SET (libsolvext_HEADERS ${libsolvext_HEADERS}
 	pool_parserpmrichdep.h)
-ENDIF (ENABLE_SUSEREPO OR ENABLE_RPMMD OR ENABLE_RPMDB)
+ENDIF (ENABLE_SUSEREPO OR ENABLE_RPMMD OR ENABLE_RPMDB OR ENABLE_RPMPKG)
 ENDIF (ENABLE_COMPLEX_DEPS)
 
 IF (SUSE)
diff --git a/ext/libsolvext.ver b/ext/libsolvext.ver
index 8774fd4..4896e85 100644
--- a/ext/libsolvext.ver
+++ b/ext/libsolvext.ver
@@ -66,6 +66,7 @@ SOLV_1.0 {
 		testcase_str2dep;
 		testcase_str2job;
 		testcase_str2repo;
+		testcase_str2solvid;
 		testcase_read;
 		testcase_resultdiff;
 		testcase_solverresult;
diff --git a/ext/repo_rpmdb.c b/ext/repo_rpmdb.c
index 95756c0..034198c 100644
--- a/ext/repo_rpmdb.c
+++ b/ext/repo_rpmdb.c
@@ -24,6 +24,8 @@
 #include <stdint.h>
 #include <errno.h>
 
+#ifdef ENABLE_RPMDB
+
 #include <rpm/rpmio.h>
 #include <rpm/rpmpgp.h>
 #ifndef RPM5
@@ -39,6 +41,8 @@
 # endif
 #endif
 
+#endif
+
 #include "pool.h"
 #include "repo.h"
 #include "hash.h"
@@ -162,10 +166,16 @@
 # define RPM_INDEX_SIZE 8	/* rpmdbid + array index */
 #endif
 
+/* some limits to guard against corrupt rpms */
+#define MAX_SIG_CNT		0x100000
+#define MAX_SIG_DSIZE		0x100000
+
+#define MAX_HDR_CNT		0x100000
+#define MAX_HDR_DSIZE		0x2000000
 
 typedef struct rpmhead {
   int cnt;
-  int dcnt;
+  unsigned int dcnt;
   unsigned char *dp;
   int forcebinary;		/* sigh, see rh#478907 */
   unsigned char data[1];
@@ -204,7 +214,7 @@ headint32array(RpmHead *h, int tag, int *cnt)
     return 0;
   o = d[8] << 24 | d[9] << 16 | d[10] << 8 | d[11];
   i = d[12] << 24 | d[13] << 16 | d[14] << 8 | d[15];
-  if (o + 4 * i > h->dcnt)
+  if (o > h->dcnt || i > h->dcnt || o + 4 * i > h->dcnt)
     return 0;
   d = h->dp + o;
   r = solv_calloc(i ? i : 1, sizeof(unsigned int));
@@ -226,7 +236,7 @@ headint32(RpmHead *h, int tag)
     return 0;
   o = d[8] << 24 | d[9] << 16 | d[10] << 8 | d[11];
   i = d[12] << 24 | d[13] << 16 | d[14] << 8 | d[15];
-  if (i == 0 || o + 4 * i > h->dcnt)
+  if (i == 0 || o > h->dcnt || i > h->dcnt || o + 4 * i > h->dcnt)
     return 0;
   d = h->dp + o;
   return d[0] << 24 | d[1] << 16 | d[2] << 8 | d[3];
@@ -243,7 +253,7 @@ headint64array(RpmHead *h, int tag, int *cnt)
     return 0;
   o = d[8] << 24 | d[9] << 16 | d[10] << 8 | d[11];
   i = d[12] << 24 | d[13] << 16 | d[14] << 8 | d[15];
-  if (o + 8 * i > h->dcnt)
+  if (o > h->dcnt || i > h->dcnt || o + 8 * i > h->dcnt)
     return 0;
   d = h->dp + o;
   r = solv_calloc(i ? i : 1, sizeof(unsigned long long));
@@ -267,7 +277,7 @@ headint64(RpmHead *h, int tag)
     return 0;
   o = d[8] << 24 | d[9] << 16 | d[10] << 8 | d[11];
   i = d[12] << 24 | d[13] << 16 | d[14] << 8 | d[15];
-  if (i == 0 || o + 8 * i > h->dcnt)
+  if (i == 0 || o > h->dcnt || i > h->dcnt || o + 8 * i > h->dcnt)
     return 0;
   d = h->dp + o;
   i = d[0] << 24 | d[1] << 16 | d[2] << 8 | d[3];
@@ -284,7 +294,7 @@ headint16array(RpmHead *h, int tag, int *cnt)
     return 0;
   o = d[8] << 24 | d[9] << 16 | d[10] << 8 | d[11];
   i = d[12] << 24 | d[13] << 16 | d[14] << 8 | d[15];
-  if (o + 4 * i > h->dcnt)
+  if (o > h->dcnt || i > h->dcnt || o + 2 * i > h->dcnt)
     return 0;
   d = h->dp + o;
   r = solv_calloc(i ? i : 1, sizeof(unsigned int));
@@ -320,6 +330,8 @@ headstringarray(RpmHead *h, int tag, int *cnt)
     return 0;
   o = d[8] << 24 | d[9] << 16 | d[10] << 8 | d[11];
   i = d[12] << 24 | d[13] << 16 | d[14] << 8 | d[15];
+  if (o > h->dcnt || i > h->dcnt)
+    return 0;
   r = solv_calloc(i ? i : 1, sizeof(char *));
   if (cnt)
     *cnt = i;
@@ -347,7 +359,7 @@ headbinary(RpmHead *h, int tag, unsigned int *sizep)
     return 0;
   o = d[8] << 24 | d[9] << 16 | d[10] << 8 | d[11];
   i = d[12] << 24 | d[13] << 16 | d[14] << 8 | d[15];
-  if (o > h->dcnt || o + i < o || o + i > h->dcnt)
+  if (o > h->dcnt || i > h->dcnt || o + i > h->dcnt)
     return 0;
   if (sizep)
     *sizep = i;
@@ -827,7 +839,7 @@ addfilelist(Repodata *data, Id handle, RpmHead *rpmhead, int flags)
       Id did;
       char *b = bn[i];
 
-      if (di[i] == lastdii)
+      if (lastdid && di[i] == lastdii)
 	did = lastdid;
       else
 	{
@@ -943,7 +955,7 @@ set_description_author(Repodata *data, Id handle, char *str)
 }
 
 static int
-rpm2solv(Pool *pool, Repo *repo, Repodata *data, Solvable *s, RpmHead *rpmhead, int flags)
+rpmhead2solv(Pool *pool, Repo *repo, Repodata *data, Solvable *s, RpmHead *rpmhead, int flags)
 {
   char *name;
   char *evr;
@@ -1075,6 +1087,12 @@ rpm2solv(Pool *pool, Repo *repo, Repodata *data, Solvable *s, RpmHead *rpmhead,
   return 1;
 }
 
+static inline unsigned int
+getu32(const unsigned char *dp)
+{
+  return dp[0] << 24 | dp[1] << 16 | dp[2] << 8 | dp[3];
+}
+
 
 /******************************************************************/
 /*  Rpm Database stuff
@@ -1087,13 +1105,17 @@ struct rpmdbstate {
   RpmHead *rpmhead;	/* header storage space */
   int rpmheadsize;
 
+#ifdef ENABLE_RPMDB
   int dbopened;
   DB_ENV *dbenv;	/* database environment */
   DB *db;		/* packages database */
   int byteswapped;	/* endianess of packages database */
   int is_ostree;	/* read-only db that lives in /usr/share/rpm */
+#endif
 };
 
+#ifdef ENABLE_RPMDB
+
 struct rpmdbentry {
   Id rpmdbid;
   Id nameoff;
@@ -1103,7 +1125,8 @@ struct rpmdbentry {
 #define NAMEDATA_BLOCK 1023
 
 
-static inline Id db2rpmdbid(unsigned char *db, int byteswapped)
+static inline Id
+db2rpmdbid(unsigned char *db, int byteswapped)
 {
 #ifdef RPM5
   return db[0] << 24 | db[1] << 16 | db[2] << 8 | db[3];
@@ -1119,7 +1142,8 @@ static inline Id db2rpmdbid(unsigned char *db, int byteswapped)
 #endif
 }
 
-static inline void rpmdbid2db(unsigned char *db, Id id, int byteswapped)
+static inline void
+rpmdbid2db(unsigned char *db, Id id, int byteswapped)
 {
 #ifdef RPM5
   db[0] = id >> 24, db[1] = id >> 16, db[2] = id >> 8, db[3] = id;
@@ -1235,6 +1259,46 @@ closedbenv(struct rpmdbstate *state)
   state->dbenv = 0;
 }
 
+#endif
+
+static void
+freestate(struct rpmdbstate *state)
+{
+  /* close down */
+  if (!state)
+    return;
+#ifdef ENABLE_RPMDB
+  if (state->db)
+    state->db->close(state->db, 0);
+  if (state->dbenv)
+    closedbenv(state);
+#endif
+  if (state->rootdir)
+    solv_free(state->rootdir);
+  solv_free(state->rpmhead);
+}
+
+void *
+rpm_state_create(Pool *pool, const char *rootdir)
+{
+  struct rpmdbstate *state;
+  state = solv_calloc(1, sizeof(*state));
+  state->pool = pool;
+  if (rootdir)
+    state->rootdir = solv_strdup(rootdir);
+  return state;
+}
+
+void *
+rpm_state_free(void *state)
+{
+  freestate(state);
+  return solv_free(state);
+}
+
+
+#ifdef ENABLE_RPMDB
+
 static int
 openpkgdb(struct rpmdbstate *state)
 {
@@ -1364,23 +1428,50 @@ getinstalledrpmdbids(struct rpmdbstate *state, const char *index, const char *ma
   return entries;
 }
 
-/* retrive header by rpmdbid */
+/* common code, return dbid on success, -1 on error */
 static int
-getrpmdbid(struct rpmdbstate *state, Id rpmdbid)
+getrpm_dbdata(struct rpmdbstate *state, DBT *dbdata, int dbid)
 {
-  unsigned char buf[16];
-  DBT dbkey;
-  DBT dbdata;
+  unsigned int dsize, cnt, l;
   RpmHead *rpmhead;
 
-  if (!rpmdbid)
+  if (dbdata->size < 8)
+    return pool_error(state->pool, -1, "corrupt rpm database (size)");
+  cnt = getu32((const unsigned char *)dbdata->data);
+  dsize = getu32((const unsigned char *)dbdata->data + 4);
+  if (cnt >= MAX_HDR_CNT || dsize >= MAX_HDR_DSIZE)
+    return pool_error(state->pool, -1, "corrupt rpm database (cnt/dcnt)");
+  l = cnt * 16 + dsize;
+  if (8 + l > dbdata->size)
+    return pool_error(state->pool, -1, "corrupt rpm database (data size)");
+  if (l + 1 > state->rpmheadsize)
     {
-      pool_error(state->pool, 0, "illegal rpmdbid");
-      return -1;
+      state->rpmheadsize = l + 128;
+      state->rpmhead = solv_realloc(state->rpmhead, sizeof(*rpmhead) + state->rpmheadsize);
     }
+  rpmhead = state->rpmhead;
+  rpmhead->forcebinary = 1;
+  rpmhead->cnt = cnt;
+  rpmhead->dcnt = dsize;
+  memcpy(rpmhead->data, (unsigned char *)dbdata->data + 8, l);
+  rpmhead->data[l] = 0;
+  rpmhead->dp = rpmhead->data + cnt * 16;
+  return dbid;
+}
+
+/* retrive header by rpmdbid, returns 0 if not found, -1 on error */
+static int
+getrpm_dbid(struct rpmdbstate *state, Id dbid)
+{
+  unsigned char buf[4];
+  DBT dbkey;
+  DBT dbdata;
+
+  if (dbid <= 0)
+    return pool_error(state->pool, -1, "illegal rpmdbid %d", dbid);
   if (state->dbopened != 1 && !openpkgdb(state))
     return -1;
-  rpmdbid2db(buf, rpmdbid, state->byteswapped);
+  rpmdbid2db(buf, dbid, state->byteswapped);
   memset(&dbkey, 0, sizeof(dbkey));
   memset(&dbdata, 0, sizeof(dbdata));
   dbkey.data = buf;
@@ -1389,39 +1480,15 @@ getrpmdbid(struct rpmdbstate *state, Id rpmdbid)
   dbdata.size = 0;
   if (state->db->get(state->db, NULL, &dbkey, &dbdata, 0))
     return 0;
-  if (dbdata.size < 8)
-    {
-      pool_error(state->pool, 0, "corrupt rpm database (size)");
-      return -1;
-    }
-  if (dbdata.size > state->rpmheadsize)
-    {
-      state->rpmheadsize = dbdata.size + 128;
-      state->rpmhead = solv_realloc(state->rpmhead, sizeof(*rpmhead) + state->rpmheadsize);
-    }
-  rpmhead = state->rpmhead;
-  memcpy(buf, dbdata.data, 8);
-  rpmhead->forcebinary = 1;
-  rpmhead->cnt = buf[0] << 24  | buf[1] << 16  | buf[2] << 8 | buf[3];
-  rpmhead->dcnt = buf[4] << 24  | buf[5] << 16  | buf[6] << 8 | buf[7];
-  if (8 + rpmhead->cnt * 16 + rpmhead->dcnt > dbdata.size)
-    {
-      pool_error(state->pool, 0, "corrupt rpm database (data size)");
-      return -1;
-    }
-  memcpy(rpmhead->data, (unsigned char *)dbdata.data + 8, rpmhead->cnt * 16 + rpmhead->dcnt);
-  rpmhead->dp = rpmhead->data + rpmhead->cnt * 16;
-  return 1;
+  return getrpm_dbdata(state, &dbdata, dbid);
 }
 
-/* retrive header by berkeleydb cursor */
+/* retrive header by berkeleydb cursor, returns 0 on EOF, -1 on error */
 static Id
-getrpmcursor(struct rpmdbstate *state, DBC *dbc)
+getrpm_cursor(struct rpmdbstate *state, DBC *dbc)
 {
-  unsigned char buf[16];
   DBT dbkey;
   DBT dbdata;
-  RpmHead *rpmhead;
   Id dbid;
 
   memset(&dbkey, 0, sizeof(dbkey));
@@ -1431,62 +1498,12 @@ getrpmcursor(struct rpmdbstate *state, DBC *dbc)
       if (dbkey.size != 4)
 	return pool_error(state->pool, -1, "corrupt Packages database (key size)");
       dbid = db2rpmdbid(dbkey.data, state->byteswapped);
-      if (dbid == 0)		/* the join key */
-	continue;
-      if (dbdata.size < 8)
-	return pool_error(state->pool, -1, "corrupt rpm database (size %u)\n", dbdata.size);
-      if (dbdata.size > state->rpmheadsize)
-	{
-	  state->rpmheadsize = dbdata.size + 128;
-	  state->rpmhead = solv_realloc(state->rpmhead, sizeof(*state->rpmhead) + state->rpmheadsize);
-	}
-      rpmhead = state->rpmhead;
-      memcpy(buf, dbdata.data, 8);
-      rpmhead->forcebinary = 1;
-      rpmhead->cnt = buf[0] << 24  | buf[1] << 16  | buf[2] << 8 | buf[3];
-      rpmhead->dcnt = buf[4] << 24  | buf[5] << 16  | buf[6] << 8 | buf[7];
-      if (8 + rpmhead->cnt * 16 + rpmhead->dcnt > dbdata.size)
-	return pool_error(state->pool, -1, "corrupt rpm database (data size)\n");
-      memcpy(rpmhead->data, (unsigned char *)dbdata.data + 8, rpmhead->cnt * 16 + rpmhead->dcnt);
-      rpmhead->dp = rpmhead->data + rpmhead->cnt * 16;
-      return dbid;
+      if (dbid)		/* ignore join key */
+        return getrpm_dbdata(state, &dbdata, dbid);
     }
   return 0;
 }
 
-static void
-freestate(struct rpmdbstate *state)
-{
-  /* close down */
-  if (!state)
-    return;
-  if (state->db)
-    state->db->close(state->db, 0);
-  if (state->dbenv)
-    closedbenv(state);
-  if (state->rootdir)
-    solv_free(state->rootdir);
-  solv_free(state->rpmhead);
-}
-
-void *
-rpm_state_create(Pool *pool, const char *rootdir)
-{
-  struct rpmdbstate *state;
-  state = solv_calloc(1, sizeof(*state));
-  state->pool = pool;
-  if (rootdir)
-    state->rootdir = solv_strdup(rootdir);
-  return state;
-}
-
-void *
-rpm_state_free(void *state)
-{
-  freestate(state);
-  return solv_free(state);
-}
-
 static int
 count_headers(struct rpmdbstate *state)
 {
@@ -1851,7 +1868,7 @@ repo_add_rpmdb(Repo *repo, Repo *ref, int flags)
 	}
       i = 0;
       s = 0;
-      while ((dbid = getrpmcursor(&state, dbc)) != 0)
+      while ((dbid = getrpm_cursor(&state, dbc)) != 0)
 	{
 	  if (dbid == -1)
 	    {
@@ -1869,7 +1886,7 @@ repo_add_rpmdb(Repo *repo, Repo *ref, int flags)
 	  if (!repo->rpmdbid)
 	    repo->rpmdbid = repo_sidedata_create(repo, sizeof(Id));
 	  repo->rpmdbid[(s - pool->solvables) - repo->start] = dbid;
-	  if (rpm2solv(pool, repo, data, s, state.rpmhead, flags | RPM_ADD_TRIGGERS))
+	  if (rpmhead2solv(pool, repo, data, s, state.rpmhead, flags | RPM_ADD_TRIGGERS))
 	    {
 	      i++;
 	      s = 0;
@@ -2005,7 +2022,7 @@ repo_add_rpmdb(Repo *repo, Repo *ref, int flags)
 		    }
 		}
 	    }
-	  res = getrpmdbid(&state, dbid);
+	  res = getrpm_dbid(&state, dbid);
 	  if (res <= 0)
 	    {
 	      if (!res)
@@ -2016,7 +2033,7 @@ repo_add_rpmdb(Repo *repo, Repo *ref, int flags)
 	      solv_free(refhash);
 	      return -1;
 	    }
-	  rpm2solv(pool, repo, data, s, state.rpmhead, flags | RPM_ADD_TRIGGERS);
+	  rpmhead2solv(pool, repo, data, s, state.rpmhead, flags | RPM_ADD_TRIGGERS);
 	  if ((flags & RPMDB_REPORT_PROGRESS) != 0)
 	    {
 	      if (done < count)
@@ -2071,12 +2088,7 @@ repo_add_rpmdb_reffp(Repo *repo, FILE *fp, int flags)
   return res;
 }
 
-static inline unsigned int
-getu32(const unsigned char *dp)
-{
-  return dp[0] << 24 | dp[1] << 16 | dp[2] << 8 | dp[3];
-}
-
+#endif
 
 Id
 repo_add_rpm(Repo *repo, const char *rpm, int flags)
@@ -2148,7 +2160,7 @@ repo_add_rpm(Repo *repo, const char *rpm, int flags)
     }
   sigcnt = getu32(lead + 96 + 8);
   sigdsize = getu32(lead + 96 + 12);
-  if (sigcnt >= 0x100000 || sigdsize >= 0x100000)
+  if (sigcnt >= MAX_SIG_CNT || sigdsize >= MAX_SIG_DSIZE)
     {
       pool_error(pool, -1, "%s: bad signature header", rpm);
       fclose(fp);
@@ -2161,7 +2173,7 @@ repo_add_rpm(Repo *repo, const char *rpm, int flags)
   if ((flags & (RPM_ADD_WITH_PKGID | RPM_ADD_WITH_HDRID)) != 0)
     {
       /* extract pkgid or hdrid from the signature header */
-      if (sigdsize > rpmheadsize)
+      if (sigdsize + 1 > rpmheadsize)
 	{
 	  rpmheadsize = sigdsize + 128;
 	  rpmhead = solv_realloc(rpmhead, sizeof(*rpmhead) + rpmheadsize);
@@ -2172,6 +2184,7 @@ repo_add_rpm(Repo *repo, const char *rpm, int flags)
 	  fclose(fp);
 	  return 0;
 	}
+      rpmhead->data[sigdsize] = 0;
       if (chksumh)
 	solv_chksum_add(chksumh, rpmhead->data, sigdsize);
       if (leadsigchksumh)
@@ -2246,7 +2259,7 @@ repo_add_rpm(Repo *repo, const char *rpm, int flags)
     }
   sigcnt = getu32(lead + 8);
   sigdsize = getu32(lead + 12);
-  if (sigcnt >= 0x100000 || sigdsize >= 0x2000000)
+  if (sigcnt >= MAX_HDR_CNT || sigdsize >= MAX_HDR_DSIZE)
     {
       pool_error(pool, -1, "%s: bad header", rpm);
       fclose(fp);
@@ -2254,7 +2267,7 @@ repo_add_rpm(Repo *repo, const char *rpm, int flags)
     }
   l = sigdsize + sigcnt * 16;
   headerend = headerstart + 16 + l;
-  if (l > rpmheadsize)
+  if (l + 1 > rpmheadsize)
     {
       rpmheadsize = l + 128;
       rpmhead = solv_realloc(rpmhead, sizeof(*rpmhead) + rpmheadsize);
@@ -2265,6 +2278,7 @@ repo_add_rpm(Repo *repo, const char *rpm, int flags)
       fclose(fp);
       return 0;
     }
+  rpmhead->data[l] = 0;
   if (chksumh)
     solv_chksum_add(chksumh, rpmhead->data, l);
   rpmhead->forcebinary = forcebinary;
@@ -2295,7 +2309,7 @@ repo_add_rpm(Repo *repo, const char *rpm, int flags)
       solv_chksum_add(chksumh, lead, l);
   fclose(fp);
   s = pool_id2solvable(pool, repo_add_solvable(repo));
-  if (!rpm2solv(pool, repo, data, s, rpmhead, flags & ~(RPM_ADD_WITH_HDRID | RPM_ADD_WITH_PKGID)))
+  if (!rpmhead2solv(pool, repo, data, s, rpmhead, flags & ~(RPM_ADD_WITH_HDRID | RPM_ADD_WITH_PKGID)))
     {
       repo_free_solvable(repo, s - pool->solvables, 1);
       solv_chksum_free(chksumh, 0);
@@ -2347,7 +2361,7 @@ repo_add_rpm_handle(Repo *repo, void *rpmhandle, int flags)
       return 0;
     }
   s = pool_id2solvable(pool, repo_add_solvable(repo));
-  if (!rpm2solv(pool, repo, data, s, rpmhead, flags))
+  if (!rpmhead2solv(pool, repo, data, s, rpmhead, flags))
     {
       repo_free_solvable(repo, s - pool->solvables, 1);
       return 0;
@@ -2599,6 +2613,8 @@ rpm_query_num(void *rpmhandle, Id what, unsigned long long notfound)
   return notfound;
 }
 
+#ifdef ENABLE_RPMDB
+
 int
 rpm_installedrpmdbids(void *rpmstate, const char *index, const char *match, Queue *rpmdbidq)
 {
@@ -2622,12 +2638,14 @@ rpm_byrpmdbid(void *rpmstate, Id rpmdbid)
   struct rpmdbstate *state = rpmstate;
   int r;
 
-  r = getrpmdbid(state, rpmdbid);
+  r = getrpm_dbid(state, rpmdbid);
   if (!r)
     pool_error(state->pool, 0, "header #%d not in database", rpmdbid);
   return r <= 0 ? 0 : state->rpmhead;
 }
 
+#endif
+
 void *
 rpm_byfp(void *rpmstate, FILE *fp, const char *name)
 {
@@ -2656,7 +2674,7 @@ rpm_byfp(void *rpmstate, FILE *fp, const char *name)
     }
   sigcnt = getu32(lead + 96 + 8);
   sigdsize = getu32(lead + 96 + 12);
-  if (sigcnt >= 0x100000 || sigdsize >= 0x100000)
+  if (sigcnt >= MAX_SIG_CNT || sigdsize >= MAX_SIG_DSIZE)
     {
       pool_error(state->pool, 0, "%s: bad signature header", name);
       return 0;
@@ -2686,14 +2704,14 @@ rpm_byfp(void *rpmstate, FILE *fp, const char *name)
     }
   sigcnt = getu32(lead + 8);
   sigdsize = getu32(lead + 12);
-  if (sigcnt >= 0x100000 || sigdsize >= 0x2000000)
+  if (sigcnt >= MAX_HDR_CNT || sigdsize >= MAX_HDR_DSIZE)
     {
       pool_error(state->pool, 0, "%s: bad header", name);
       return 0;
     }
   l = sigdsize + sigcnt * 16;
   /* headerend = headerstart + 16 + l; */
-  if (l > state->rpmheadsize)
+  if (l + 1 > state->rpmheadsize)
     {
       state->rpmheadsize = l + 128;
       state->rpmhead = solv_realloc(state->rpmhead, sizeof(*state->rpmhead) + state->rpmheadsize);
@@ -2704,6 +2722,7 @@ rpm_byfp(void *rpmstate, FILE *fp, const char *name)
       pool_error(state->pool, 0, "%s: unexpected EOF", name);
       return 0;
     }
+  rpmhead->data[l] = 0;
   rpmhead->forcebinary = forcebinary;
   rpmhead->cnt = sigcnt;
   rpmhead->dcnt = sigdsize;
@@ -2730,19 +2749,22 @@ rpm_byrpmh(void *rpmstate, Header h)
     return 0;
   sigcnt = getu32(uh);
   sigdsize = getu32(uh + 4);
+  if (sigcnt >= MAX_HDR_CNT || sigdsize >= MAX_HDR_DSIZE)
+    return 0;
   l = sigdsize + sigcnt * 16;
-  if (l > state->rpmheadsize)
+  if (l + 1 > state->rpmheadsize)
     {
       state->rpmheadsize = l + 128;
       state->rpmhead = solv_realloc(state->rpmhead, sizeof(*state->rpmhead) + state->rpmheadsize);
     }
   rpmhead = state->rpmhead;
-  memcpy(rpmhead->data, uh + 8, l - 8);
+  memcpy(rpmhead->data, uh + 8, l);
+  rpmhead->data[l] = 0;
   free((void *)uh);
   rpmhead->forcebinary = 0;
   rpmhead->cnt = sigcnt;
   rpmhead->dcnt = sigdsize;
-  rpmhead->dp = rpmhead->data + rpmhead->cnt * 16;
+  rpmhead->dp = rpmhead->data + sigcnt * 16;
   return rpmhead;
 }
 
diff --git a/ext/repo_susetags.c b/ext/repo_susetags.c
index be73a7f..83967e0 100644
--- a/ext/repo_susetags.c
+++ b/ext/repo_susetags.c
@@ -330,7 +330,7 @@ commit_diskusage(struct parsedata *pd, Id handle)
  *
  */
 
-static inline unsigned
+static inline unsigned int
 tag_from_string(char *cs)
 {
   unsigned char *s = (unsigned char *)cs;
@@ -478,6 +478,7 @@ repo_add_susetags(Repo *repo, FILE *fp, Id defvendor, const char *language, int
   Solvable *s;
   Offset freshens;
   int intag = 0;
+  int intag_linestart = 0;
   int cummulate = 0;
   int indesc = 0;
   int indelta = 0;
@@ -558,10 +559,9 @@ repo_add_susetags(Repo *repo, FILE *fp, Id defvendor, const char *language, int
 
   for (;;)
     {
-      unsigned tag;
-      char *olinep; /* old line pointer */
+      unsigned int tag;
       char line_lang[6];
-      int keylen = 3;
+      int keylen;
 
       if (pd.ret)
 	break;
@@ -574,84 +574,86 @@ repo_add_susetags(Repo *repo, FILE *fp, Id defvendor, const char *language, int
 	}
       if (!fgets(linep, aline - (linep - line), fp)) /* read line */
 	break;
-      olinep = linep;
       linep += strlen(linep);
       if (linep == line || linep[-1] != '\n')
         continue;
       pd.lineno++;
       *--linep = 0;
-      if (linep == olinep)
-	continue;
 
       if (intag)
 	{
-	  /* check for multi-line value tags (+Key:/-Key:) */
-
-	  int is_end = (linep[-intag - keylen + 1] == '-')
-	              && (linep[-1] == ':')
-		      && (linep == line + 1 + intag + 1 + 1 + 1 + intag + 1 || linep[-intag - keylen] == '\n');
-	  if (is_end
-	      && strncmp(linep - 1 - intag, line + 1, intag))
-	    {
-	      pool_debug(pool, SOLV_ERROR, "susetags: Nonmatching multi-line tags: %d: '%s' '%s' %d\n", pd.lineno, linep - 1 - intag, line + 1, intag);
-	    }
-	  if (cummulate && !is_end)
+	  /* in multi-line value tags (+Key:/-Key:), check for end, cummulate */
+	  int is_end = line[intag_linestart] == '-' && linep[-1] == ':' && linep - line == intag_linestart + intag + 2;
+	  if (is_end && strncmp(linep - 1 - intag, line + 1, intag))
 	    {
-	      *linep++ = '\n';
-	      continue;
+	      pool_debug(pool, SOLV_ERROR, "susetags: Nonmatching multi-line tags: %d: '%s' '%.*s'\n", pd.lineno, linep - 1 - intag, intag, line + 1);
 	    }
-	  if (cummulate && is_end)
+	  if (!is_end)
 	    {
-	      linep[-intag - keylen + 1] = 0;
-	      if (linep[-intag - keylen] == '\n')
-	        linep[-intag - keylen] = 0;
-	      linep = line;
-	      intag = 0;
+	      if (cummulate)
+		{
+		  *linep++ = '\n';
+		  intag_linestart = linep - line;
+		  continue;
+		}
+	      intag_linestart = intag + 3;
+	      linep = line + intag_linestart;
+	      if (!*linep)
+		continue;		/* ignore empty lines, bnc#381828 */
 	    }
-	  if (!cummulate && is_end)
+	  else
 	    {
 	      intag = 0;
 	      linep = line;
-	      continue;
+	      if (!cummulate)
+		continue;
+	      line[intag_linestart] = 0;
+	      if (line[intag_linestart - 1] == '\n')
+	        line[intag_linestart - 1] = 0;		/* strip trailing newline */
 	    }
-	  if (!cummulate && !is_end)
-	    linep = line + intag + keylen;
 	}
       else
 	linep = line;
 
-      if (!intag && line[0] == '+' && line[1] && line[1] != ':') /* start of +Key:/-Key: tag */
+      /* ignore comments and empty lines */
+      if (!*line || *line == '#')
+	continue;
+
+      /* ignore malformed lines */
+      if (!(line[0] && line[1] && line[2] && line[3] && (line[4] == ':' || line[4] == '.')))
+        continue;
+
+      if (!intag && line[0] == '+' && line[1] != ':') /* start of +Key:/-Key: tag */
 	{
 	  char *tagend = strchr(line, ':');
-	  if (!tagend)
+	  if (!tagend || tagend - line > 100)
 	    {
 	      pd.ret = pool_error(pool, -1, "susetags: line %d: bad line '%s'\n", pd.lineno, line);
 	      break;
 	    }
-	  intag = tagend - (line + 1);
+	  intag = tagend - (line + 1);		/* set to tagsize */
 	  cummulate = 0;
-	  switch (tag_from_string(line))       /* check if accumulation is needed */
+	  switch (tag_from_string(line))	/* check if accumulation is needed */
 	    {
 	      case CTAG('+', 'D', 'e', 's'):
 	      case CTAG('+', 'E', 'u', 'l'):
 	      case CTAG('+', 'I', 'n', 's'):
 	      case CTAG('+', 'D', 'e', 'l'):
 	      case CTAG('+', 'A', 'u', 't'):
-	        if (line[4] == ':' || line[4] == '.')
-	          cummulate = 1;
+	        cummulate = 1;
 		break;
 	      default:
 		break;
 	    }
-	  line[0] = '=';                       /* handle lines between +Key:/-Key: as =Key: */
-	  line[intag + keylen - 1] = ' ';
-	  linep = line + intag + keylen;
+	  line[0] = '=';			/* handle lines between +Key:/-Key: as =Key: */
+	  line[intag + 2] = ' ';
+	  intag_linestart = intag + 3;
+	  linep = line + intag_linestart;
 	  continue;
 	}
-      if (*line == '#' || !*line)
-	continue;
-      if (! (line[0] && line[1] && line[2] && line[3] && (line[4] == ':' || line[4] == '.')))
-        continue;
+
+      /* support language suffix */
+      keylen = 3;
       line_lang[0] = 0;
       if (line[4] == '.')
         {
@@ -667,6 +669,7 @@ repo_add_susetags(Repo *repo, FILE *fp, Id defvendor, const char *language, int
               line_lang[langsize] = 0;
             }
         }
+
       tag = tag_from_string(line);
 
       if (indelta)
diff --git a/ext/testcase.c b/ext/testcase.c
index 52c139f..a56c4db 100644
--- a/ext/testcase.c
+++ b/ext/testcase.c
@@ -115,6 +115,7 @@ static struct solverflags2str {
   { SOLVER_FLAG_YUM_OBSOLETES,              "yumobsoletes", 0 },
   { SOLVER_FLAG_NEED_UPDATEPROVIDE,         "needupdateprovide", 0 },
   { SOLVER_FLAG_URPM_REORDER,               "urpmreorder", 0 },
+  { SOLVER_FLAG_FOCUS_BEST,                 "focusbest", 0 },
   { 0, 0, 0 }
 };
 
@@ -767,6 +768,7 @@ testcase_str2solvid(Pool *pool, const char *str)
 	  evrid = pool_strn2id(pool, str + i + 1, repostart - (i + 1), 0);
 	  if (!evrid)
 	    continue;
+	  /* first check whatprovides */
 	  FOR_PROVIDES(p, pp, nid)
 	    {
 	      Solvable *s = pool->solvables + p;
@@ -778,6 +780,31 @@ testcase_str2solvid(Pool *pool, const char *str)
 		continue;
 	      return p;
 	    }
+	  /* maybe it's not installable and thus not in whatprovides. do a slow search */
+	  if (repo)
+	    {
+	      Solvable *s;
+	      FOR_REPO_SOLVABLES(repo, p, s)
+		{
+		  if (s->name != nid || s->evr != evrid)
+		    continue;
+		  if (arch && s->arch != arch)
+		    continue;
+		  return p;
+		}
+	    }
+	  else
+	    {
+	      FOR_POOL_SOLVABLES(p)
+		{
+		  Solvable *s = pool->solvables + p;
+		  if (s->name != nid || s->evr != evrid)
+		    continue;
+		  if (arch && s->arch != arch)
+		    continue;
+		  return p;
+		}
+	    }
 	}
     }
   return 0;
@@ -2328,7 +2355,7 @@ testcase_write(Solver *solv, const char *dir, int resultflags, const char *testc
       Repo *repo = pool_id2repo(pool, repoid);
       char *buf = solv_malloc((repo->name ? strlen(repo->name) : 0) + 40);
       char *mp;
-      orignames[i] = repo->name;
+      orignames[repoid] = repo->name;
       if (!repo->name || !repo->name[0])
         sprintf(buf, "#%d", repoid);
       else
@@ -2353,7 +2380,7 @@ testcase_write(Solver *solv, const char *dir, int resultflags, const char *testc
     {
       Repo *repo = pool_id2repo(pool, repoid);
       solv_free((void *)repo->name);
-      repo->name = orignames[i];
+      repo->name = orignames[repoid];
     }
   solv_free(orignames);
   return r;
@@ -2480,6 +2507,7 @@ testcase_read(Pool *pool, FILE *fp, const char *testcase, Queue *job, char **res
   int missing_features = 0;
   Id *genid = 0;
   int ngenid = 0;
+  Queue autoinstq;
 
   if (!fp && !(fp = fopen(testcase, "r")))
     {
@@ -2495,6 +2523,7 @@ testcase_read(Pool *pool, FILE *fp, const char *testcase, Queue *job, char **res
   buf = solv_malloc(bufl);
   bufp = buf;
   solv = 0;
+  queue_init(&autoinstq);
   for (;;)
     {
       if (bufp - buf + 16 > bufl)
@@ -2849,6 +2878,15 @@ testcase_read(Pool *pool, FILE *fp, const char *testcase, Queue *job, char **res
 	    }
 	  genid[ngenid++] = id;
 	}
+      else if (!strcmp(pieces[0], "autoinst") && npieces > 2)
+	{
+	  if (strcmp(pieces[1], "name"))
+	    {
+	      pool_debug(pool, SOLV_ERROR, "testcase_read: autoinst: illegal mode\n");
+	      break;
+	    }
+	  queue_push(&autoinstq, pool_str2id(pool, pieces[2], 1));
+	}
       else
 	{
 	  pool_debug(pool, SOLV_ERROR, "testcase_read: cannot parse command '%s'\n", pieces[0]);
@@ -2856,6 +2894,9 @@ testcase_read(Pool *pool, FILE *fp, const char *testcase, Queue *job, char **res
     }
   while (job && ngenid > 0)
     queue_push2(job, SOLVER_NOOP | SOLVER_SOLVABLE_PROVIDES, genid[--ngenid]);
+  if (autoinstq.count)
+    pool_add_userinstalled_jobs(pool, &autoinstq, job, GET_USERINSTALLED_NAMES | GET_USERINSTALLED_INVERTED);
+  queue_free(&autoinstq);
   genid = solv_free(genid);
   buf = solv_free(buf);
   pieces = solv_free(pieces);