summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2011-10-24Eliminate broken pgpLen() from the APIPanu Matilainen2-21/+21
- pgpLen() only works for new format packets, and even for those its unsafe and cannot be fixed without breaking the API. Start by taking it behind the barn for further, err, operations. Rpm has no users outside rpmpgp.c now and anybody else using it will be better off not doing so.
2011-10-24Sanitize pgpsigFormat()Panu Matilainen1-36/+13
- Eliminate bogus size calculations: we have a buffer of td->count size that may or may not contain legal OpenPGP signature. Leave it up to pgpPrtPkts() to validate & figure it out and check its return code instead, eliminating need to repeat a bunch of tedious calculations here. - Use non-zero signature version is used as a hint for valid signature, should be "close enough" for the rest of the code.
2011-10-24Valid PGP packets are always at least two bytes longPanu Matilainen1-2/+2
- Old format tags encode the number of body length bytes in the packet header, new format encodes it in the first body length byte. In both cases there must be at least two bytes worth of data for it to be a valid header. Sanity check before accessing.
2011-10-23Fix unterminated buffer after readlink() callThomas Jarosch1-2/+6
readlink() never terminates the buffer. Detected by "cppcheck" (git HEAD) Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com> Signed-off-by: Panu Matilainen <pmatilai@redhat.com>
2011-10-23Log an error on signing if we can't even parse the gpg-generated signaturePanu Matilainen1-1/+3
- The error message is not very helpful but if pgpPrtPkts() fails we dont have a whole lot clue in the caller why it failed, spitting out at least *some* error is better than silently failing (RhBug:748116, RhBug:719154)
2011-10-23Warn but don't fail the build on missing excluded files (RhBug:745629)Panu Matilainen1-3/+12
- If a file/directory is not to be packaged, there's not a whole lot point making the build fail if its missing. In case exclude is used to leave certain files to sub-packages, the sub-package file lists will catch out missing files that are really missing as a result of actual build failure or such (except perhaps for some glob cases but missing files can go unnoticed in those cases anyway)
2011-10-23Eliminate bunch of exit points in addFile()Panu Matilainen1-6/+10
- Assume failure, handle setting fl->processingFailed centrally at exit (file too large wasn't resulting in processingFailed getting set)
2011-10-21Fix ancient off-by-one at end boundary in string array size calculationPanu Matilainen2-17/+19
- String array size calculation could read one byte past data end pointer when expected count and number of \0's disagree (ie invalid data) due to while condition side-effects + bounds checking being in the inner loop. - Lift the string length calculation to inline helper function, used for both string and string array types. - Streamline the calculations: - Eliminate unnecessary length increments, calculate the length from pointer distance - Eliminate end pointer NULL checking within the loop: when caller doesn't supply end pointer, cap to HEADER_MAX_DATA (ie 16MB), anything larger would trip up in later hdrchkData() checks anyway. - Avoid the off-by-one by eliminating the problematic inner loop.
2011-10-20Verify the entire region trailer, not just its offset, is within data areaPanu Matilainen3-5/+6
- Offset being within the data area doesn't help if the actual data doesn't fit. Since the trailer size is well known, we can just as easily make the check accurate to prevent reading beyond end of data in case the offset is subtly wrong. - In headerLoad(), region offset of zero doesn't need sanity checking, only validate if its something else and do so accurately there too.
2011-10-17Update man page(s) verify output description to match current behaviorPanu Matilainen7-13/+13
- Since addition of file capability verification in rpm 4.7.x, the verify output has nine characters, not eight (RhBug:746525)
2011-10-12Fix pretrans dependency calculation when provider is upgradedPanu Matilainen1-10/+17
- Pretrans-dependencies are twisty little beasts unlike anything else... When a pretrans-dependency provider is updated, the currently installed version is the provider for that transaction, unlike others where the packages from installing set act as providers for updates. So when looking up pretrans deps, we must not prune the to-be-erased packages from the db match iterators. As an added twist, we also must not cache these non-pruned cases as it would mess up the cache for "regular" dependencies. - Fixes this case reported on fedora-devel: http://lists.fedoraproject.org/pipermail/devel/2011-October/158058.html
2011-10-11rpmio: Set a umask before using mkstemp()Mukund Sivaraman1-0/+6
This commit sets a restrictive umask before calling mkstemp(). This is because the permissions of files created by mkstemp() are not defined in POSIX. Old versions of glibc created files with mode 0666 which can be a security hole. Because the behavior is implementation-dependent, we set a umask.
2011-10-11rpmio: Don't de-ref lzfile which was freed in lzclose()Mukund Sivaraman1-1/+3
2011-10-11build: Update .gitignore rulesMukund Sivaraman4-2/+8
2011-10-11Let headerLoad() failure message come throughPanu Matilainen1-1/+2
- headerVerify() always returns with a message even for OK results, which was masking the error message from headerLoad(), sometimes giving not very helpful "headerRead failed: Header sanity check OK" style messages.
2011-10-06Eliminate headerCheckPayloadFormat() from the APIPanu Matilainen3-37/+31
- While we're on API killing spree... Exporting this was needless and dumb to begin with (greetings to self in 2007...), bury it inside depends.c as static and let rot there. - Might be a better idea to kill it completely with some other mechanism such as turning payload format into rpmlib() dependency internally but just get it out of public sight for now.
2011-10-06Eliminate headerMergeLegacySigs() from the APIPanu Matilainen3-13/+6
- No need to export this in the API - if you want merged signature tags you use rpm's package reading functions.
2011-10-06Eliminate leftover headerRegenSigHeader() functionPanu Matilainen2-55/+0
- This was only ever used by repackage support inside rpm and has been orphan since 2008, likely more than just a little broken too as it doesn't know about 64bit types and all. RIP.
2011-10-06Only bother allocating a pgpDig when neededPanu Matilainen1-9/+3
- Now that rpmVerifySignature() doesn't require a non-null dig for digests, don't bother allocating one unless necessary. - pgpNewDig() cannot fail so dont bother checking.
2011-10-06Eliminate redundant NULL-checks in lower level sigchecking functionsPanu Matilainen1-9/+3
- sigtd->data and dig checking (where needed) is done at rpmVerifySignature() level, dont bother double-checking - Hash context is dup'ed, which CAN fail, so while we dont need to check the argument for non-null, the dup result needs to be checked for digests. For actual signatures the dup happens elsewhere, we dont need to check the argument for non-null here.
2011-10-06Sanitize rpmVerifySignature() a bitPanu Matilainen1-7/+13
- Hash context is required for everything, require non-NULL ctx in rpmVerifySignature() already - pgpDig is only relevant for true signature, digest checking doesn't need it - dont require dummy dig to be passed for digests. - Treat unknown signatures as a case of bad parameters: we're the only caller of rpmVerifySignature() so it'd be us screwing up if we ask for unknown signature to be verified. - Treat bad parameters as a hard failure instead of "not found", bad parameters mean we cannot verify the signature which really equals FAIL.
2011-10-06Also add RPMTAG_OPTFLAGS during spec parse since we easily can...Panu Matilainen2-5/+3
2011-10-06Add implicit self-provides during spec parse alreadyPanu Matilainen2-35/+32
- Makes the self-provides accessible on spec parse queries, shouldn't affect anything else.
2011-10-05Split signature/digest verification out of headerVerify()Panu Matilainen1-114/+134
- headerVerify() is big enough without having all the signature goo inline, just lift the whole signature/digest business into separate function. Supposedly no functional changes...
2011-10-05Unobfuscate header digest calculation in headerVerify()Panu Matilainen1-18/+5
- Assigning goo to temporary variables for calling rpmDigestUpdate() doesn't make it any more readable, more the contrary. Also don't bother with htonl() (calls that should've been ntohl() for "correctness") when we have the data elsewhere in host order already.
2011-10-05Unobfuscate headerVerify() exit logicPanu Matilainen1-30/+20
- Jumping forwards is one thing, jumping backwards and forwards to an exit label residing in the middle of a function is something else... Refactor to single point of exit, at the end of the function. - Handle the no header-only signature/digest case (whether disabled or v3 package) and cleanup centrally at the exit label, everything falls through there now.
2011-10-05Eliminate pointless exit label from headerVerify()Panu Matilainen1-3/+0
- pgpNewDig() like most rpm "constructor" functions cannot fail, no point checking the result. Allows an icky backwards goto + label to be eliminated.
2011-10-04Push couple of variables to more local scopePanu Matilainen1-3/+3
- No functional changes, just preparing to tidy up the headerVerify() monster a bit.
2011-10-04Eliminate redundant local variable in headerLoad()Panu Matilainen1-2/+0
2011-10-03Sanity check region length on header loadPanu Matilainen1-0/+5
- Region size can't obviously be larger than the containing header, sanity check to avoid crashes from malformed packages. - We should really test for length equality here, but with dribbles the size is sometimes off by three, whatever the reason (bug likely), leaving that investigation for some sunnier day...
2011-09-30Sanity check OpenPGP packet lengths in pgpPrtSubType()Panu Matilainen1-3/+8
- Sub-packet prefix length + packet length can't very well be larger than the remaining packet length. In addition to sanity checking, return an error code and have callers actually check for it. - Fixes (yet another) segfault on malformed package (RhBug:742499)
2011-09-29Sanity check region offset range on headerLoad()Panu Matilainen1-1/+1
- Fixes the first case crash of RhBug:741606 / CVE-2011-3378 where immutable region offset is way out of bounds.
2011-09-29Sanity check region offset in regionSwab()Panu Matilainen1-0/+3
- Region offsets are supposed to be negative when when an entry is involved, otherwise zero. Fixes some cases of crash'n'burn on malformed headers having bogus offsets (CVE-2011-3378)
2011-09-15Whoops, ftell() and rpmio equivalents should return long not off_tPanu Matilainen1-1/+1
2011-09-15Fix up a few strict-prototype warnings on x86Panu Matilainen1-3/+3
2011-09-15Kick out ppc arch detection leftoversPanu Matilainen1-12/+0
- This should've been in commit 6e2f56fe25a9ee62af51e0408861a8a43c97a709 all the way back then, unused ever since...
2011-09-15Eliminate hysterical copy-paste comments from rpmrcPanu Matilainen1-16/+0
2011-09-15Bit of rpmrc spring-cleaning: nuke detection for some extinct creaturesPanu Matilainen1-57/+3
2011-09-13Add Transifex config + adjust .gitignore to track itPanu Matilainen2-0/+9
2011-09-13Nuke ancient ChangeLog in po/Panu Matilainen1-6/+0
2011-09-12Use POPT_BIT_SET for setting the scriptlet flagsPanu Matilainen1-7/+4
- No functional changes, just avoid doing extra work for what popt can already do for us.
2011-09-12Actually remember scriptlet flags in the rpmScript structPanu Matilainen1-2/+3
- Currently doesn't make any difference but since we actually have a flags member in the struct, might as well use it. Also we'll shortly be needing these during the actual execution too.
2011-09-12Rename scriptlet flags from RPMSCRIPT_FOO to RPMSCRIPT_FLAG_FOOPanu Matilainen3-7/+7
- No functional changes (and this is still internal-only API), just making more obvious what they are and clearing the RPMSCRIPT_FOO namespace for possible future use for the scriptlet types themselves.
2011-09-12Show all interpreter arguments on --scripts query (ticket #847)Panu Matilainen1-14/+14
- Previously any arguments to interpreter were invisible unless you happened to know that RPMTAG_FOOPROG are actually string arrays despite their type showing plain string, and queried as arrays. This makes all the arguments for all scriptlets supporting interpreter arguments visible on --scripts query and also serves as an example on how to properly query them.i - Perhaps worth noting is the exact formatting of the query: "(using[ %{PRETRANSPROG}]" instead of the more typical style of "(using [%{PRETRANSPROG} ]" to avoid extra trailing blanks.
2011-09-12Show possible %verifyscript interpreter similarly to other scriptletsPanu Matilainen1-1/+3
2011-09-12Scriptlet argument tags are really arraysPanu Matilainen1-7/+7
- While the vast majority of scriptlet interpreters only consist of the interpreter name itself, they all can consist of arbitrary number of extra arguments. Rpm itself doesn't really care whether the tags are strings or string arrays but the scalar definition causes the rest of arguments to be invisible from eg python. Also having the type shown as string array hints at the proper query format when accessing these (and rpm itself is doing it wrong too in --scripts alias). Related to ticket #847.
2011-09-12Sanity check trigger scriptlet arguments on buildPanu Matilainen1-0/+6
- Trigger scriptlets differ from other types in that additional arguments to scriptlet interpreter are not supported due to the way trigger data is stored in the header. Until now any extra arguments have just been quietly discarded, make it an hard error to avoid surprises.
2011-09-06Fix brp-python-bytecompile breakage from the recent whitespace patchPanu Matilainen1-1/+1
2011-09-06Use the new FOO_NEVRS extensions for --requires etc popt aliasesPanu Matilainen1-8/+8
- Makes the popt foobar somewhat saner and fixes RhBug:717534 and RhBug:735801 while at it.
2011-09-06Add four new extension tags for pretty-formatting dependenciesPanu Matilainen3-0/+53
- The current method that --requires and friends use is kinda cumbersome and outputs extra whitespace for dependencies which dont have flags+version attached. Adding extensions for this is likely to be easier than teaching query formatting to permit conditionalizing on current value instead of just tag existence.
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-24 05:03:08 +0000