RPM Package Manager, CVS Repository
http://rpm5.org/cvs/
____________________________________________________________________________
Server: rpm5.org Name: Jeff Johnson
Root: /v/rpm/cvs Email: [EMAIL PROTECTED]
Module: rpm Date: 22-Apr-2008 23:24:11
Branch: HEAD Handle: 2008042221241100
Modified files:
rpm CHANGES
rpm/rpmdb header.c
Log:
- jbj: header: fix: avoid double free with damaged data (#442761).
Summary:
Revision Changes Path
1.2302 +1 -0 rpm/CHANGES
1.154 +3 -1 rpm/rpmdb/header.c
____________________________________________________________________________
patch -p0 <<'@@ .'
Index: rpm/CHANGES
============================================================================
$ cvs diff -u -r1.2301 -r1.2302 CHANGES
--- rpm/CHANGES 15 Apr 2008 13:18:37 -0000 1.2301
+++ rpm/CHANGES 22 Apr 2008 21:24:11 -0000 1.2302
@@ -1,5 +1,6 @@
5.1.0 -> 5.2a0:
+ - jbj: header: fix: avoid double free with damaged data (#442761).
- jbj: rpmte: revert to individual tags instead of RPMTAG_NVRA.
- jbj: rpmte: fix: snip ".arch" from "-release", same NEVRA check broke.
- afb: fix VPATH builds finding rpmversion.h (in build)
@@ .
patch -p0 <<'@@ .'
Index: rpm/rpmdb/header.c
============================================================================
$ cvs diff -u -r1.153 -r1.154 header.c
--- rpm/rpmdb/header.c 23 Mar 2008 13:01:38 -0000 1.153
+++ rpm/rpmdb/header.c 22 Apr 2008 21:24:11 -0000 1.154
@@ -1255,6 +1255,7 @@
entryInfo pe = (entryInfo) (ei + 2);
/[EMAIL PROTECTED]@*/
unsigned char * dataStart = (unsigned char *) (pe + ntohl(ei[0]));
+ unsigned char * dataEnd;
uint32_t rdl;
uint32_t ril;
@@ -1281,9 +1282,10 @@
/[EMAIL PROTECTED]@*/
dataStart = (unsigned char *) memcpy(pe + ril, dataStart, rdl);
+ dataEnd = dataStart + rdl;
/[EMAIL PROTECTED]@*/
- rdlen = regionSwab(NULL, ril, 0, pe, dataStart, NULL, 0);
+ rdlen = regionSwab(NULL, ril, 0, pe, dataStart, dataEnd, 0);
/* XXX 1 on success. */
rc = (rdlen == 0) ? 0 : 1;
} else {
@@ .
______________________________________________________________________
RPM Package Manager http://rpm5.org
CVS Sources Repository [email protected]
