51 lines
1.9 KiB
Diff
51 lines
1.9 KiB
Diff
commit eed7b9c9b14542170f9cb805cfb588b1f8f1a3a2
|
|
Author: Panu Matilainen <pmatilai@redhat.com>
|
|
Date: Tue Feb 14 11:27:46 2012 +0200
|
|
|
|
Validate negated offsets too in headerVerifyInfo()
|
|
|
|
- Undo the ancient broken fix for RhBug:71996 from commit
|
|
9e06e3b8ca76ae55eaf2c4e37ba9cac729789014: instead of disabling
|
|
the check, pass in the correct upper range which is entirely
|
|
different from everything else for the region trailer tag.
|
|
|
|
diff --git a/lib/header.c b/lib/header.c
|
|
index a64264e..62bebeb 100644
|
|
--- a/lib/header.c
|
|
+++ b/lib/header.c
|
|
@@ -171,7 +171,7 @@ int headerVerifyInfo(int il, int dl, const void * pev, void * iv, int negate)
|
|
return i;
|
|
if (hdrchkAlign(info->type, info->offset))
|
|
return i;
|
|
- if (!negate && hdrchkRange(dl, info->offset))
|
|
+ if (hdrchkRange(dl, info->offset))
|
|
return i;
|
|
if (hdrchkData(info->count))
|
|
return i;
|
|
diff --git a/lib/package.c b/lib/package.c
|
|
index 755d034..432d06f 100644
|
|
--- a/lib/package.c
|
|
+++ b/lib/package.c
|
|
@@ -270,7 +270,7 @@ static rpmRC headerVerify(rpmKeyring keyring, rpmVSFlags vsflags,
|
|
(void) memcpy(&info, regionEnd, REGION_TAG_COUNT);
|
|
regionEnd += REGION_TAG_COUNT;
|
|
|
|
- xx = headerVerifyInfo(1, dl, &info, &entry.info, 1);
|
|
+ xx = headerVerifyInfo(1, il * sizeof(*pe), &info, &entry.info, 1);
|
|
if (xx != -1 ||
|
|
!(entry.info.tag == RPMTAG_HEADERIMMUTABLE
|
|
&& entry.info.type == REGION_TAG_TYPE
|
|
diff --git a/lib/signature.c b/lib/signature.c
|
|
index f24d85b..573d73d 100644
|
|
--- a/lib/signature.c
|
|
+++ b/lib/signature.c
|
|
@@ -202,7 +202,7 @@ rpmRC rpmReadSignature(FD_t fd, Header * sighp, sigType sig_type, char ** msg)
|
|
}
|
|
dataEnd += REGION_TAG_COUNT;
|
|
|
|
- xx = headerVerifyInfo(1, dl, &info, &entry.info, 1);
|
|
+ xx = headerVerifyInfo(1, il * sizeof(*pe), &info, &entry.info, 1);
|
|
if (xx != -1 ||
|
|
!((entry.info.tag == RPMTAG_HEADERSIGNATURES || entry.info.tag == RPMTAG_HEADERIMAGE)
|
|
&& entry.info.type == REGION_TAG_TYPE
|
