All of lore.kernel.org
 help / color / mirror / Atom feed
From: Steve Sakoman <steve@sakoman.com>
To: openembedded-core@lists.openembedded.org
Subject: [OE-core][dunfell 12/20] rpm: fix intermittent compression failure in do_package_write_rpm
Date: Mon, 21 Feb 2022 04:14:10 -1000	[thread overview]
Message-ID: <b093005d31467d89b00af621f86eb5cac7f845af.1645452535.git.steve@sakoman.com> (raw)
In-Reply-To: <cover.1645452535.git.steve@sakoman.com>

From: "bkylerussell@gmail.com" <bkylerussell@gmail.com>

rpmbuild can start processing random memory when processing the value
provided by XZ_THREADS, and unintentionally disable encoding for a
file descriptor that in fact requires encoding to be enabled in order
for lzwrite() to actually create an rpm.

  *** Fdopen(0x7f2030002b30,w6T16.xzdio)  | fdio 23 fp (nil)
  ==>     lzopen_internal("w6T16", 23, 1)
  ==>     lzopen_internal set encoding
  ==>     lzopen_internal clear encoding
  ==> Fdopen(0x7f2030002b30,"w6T16.xzdio") returns fd 0x7f2030002b30      | xzdio 0x7f2030004e30 fp 23 | fdio -1 fp (nil)
  ==>     lzwrite(0x7f2030004e30, 0x7f20789d8070, 6) encoding 0
  ==>     Fwrite(0x7f2030002b30,0x7f20789d8070,6) rc -1   | xzdio 0x7f2030004e30 fp 23 | fdio -1 fp (nil)
  error: create archive failed: cpio: write

When the encoding bit gets cleared on the LZFILE* struct, lzwrite() then
rightfully complains when it detects !lzfile->encoding, which then gets
bubbled up as a write failure when we go to create the archive.

This fix is available in the rpm 4.17-release.

Signed-off-by: Kyle Russell <bkylerussell@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
 ..._internal-mode-parsing-when-Tn-is-us.patch | 34 +++++++++++++++++++
 meta/recipes-devtools/rpm/rpm_4.14.2.1.bb     |  1 +
 2 files changed, 35 insertions(+)
 create mode 100644 meta/recipes-devtools/rpm/files/0001-rpmio-Fix-lzopen_internal-mode-parsing-when-Tn-is-us.patch

diff --git a/meta/recipes-devtools/rpm/files/0001-rpmio-Fix-lzopen_internal-mode-parsing-when-Tn-is-us.patch b/meta/recipes-devtools/rpm/files/0001-rpmio-Fix-lzopen_internal-mode-parsing-when-Tn-is-us.patch
new file mode 100644
index 0000000000..9a5ebb9115
--- /dev/null
+++ b/meta/recipes-devtools/rpm/files/0001-rpmio-Fix-lzopen_internal-mode-parsing-when-Tn-is-us.patch
@@ -0,0 +1,34 @@
+From 405fc8998181353bd510864ca251dc233afec276 Mon Sep 17 00:00:00 2001
+From: Vitaly Chikunov <vt@altlinux.org>
+Date: Wed, 6 Jan 2021 23:43:41 +0300
+Subject: [PATCH] rpmio: Fix lzopen_internal mode parsing when 'Tn' is used
+
+When there is number after "T" (suggested number of threads or "0" for
+getncpus), lzopen_internal() mode parser would skip one byte, and when
+it's at the end of the string it would then parse undesired garbage from
+the memory, making intermittent compression failures.
+
+Fixes: 7740d1098 ("Add support for multithreaded xz compression")
+Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
+
+Upstream-Status: Backport [https://github.com/rpm-software-management/rpm/commit/405fc8998181353bd510864ca251dc233afec276]
+
+---
+ rpmio/rpmio.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/rpmio/rpmio.c b/rpmio/rpmio.c
+index ed1e25140..9d32ec6d9 100644
+--- a/rpmio/rpmio.c
++++ b/rpmio/rpmio.c
+@@ -798,6 +798,7 @@ static LZFILE *lzopen_internal(const char *mode, int fd, int xz)
+ 		 * should've processed
+ 		 * */
+ 		while (isdigit(*++mode));
++		--mode;
+ 	    }
+ #ifdef HAVE_LZMA_MT
+ 	    else
+-- 
+2.25.1
+
diff --git a/meta/recipes-devtools/rpm/rpm_4.14.2.1.bb b/meta/recipes-devtools/rpm/rpm_4.14.2.1.bb
index c39a5208e5..376021d913 100644
--- a/meta/recipes-devtools/rpm/rpm_4.14.2.1.bb
+++ b/meta/recipes-devtools/rpm/rpm_4.14.2.1.bb
@@ -44,6 +44,7 @@ SRC_URI = "git://github.com/rpm-software-management/rpm;branch=rpm-4.14.x;protoc
            file://0001-mono-find-provides-requires-do-not-use-monodis-from-.patch \
            file://0001-Rip-out-partial-support-for-unused-MD2-and-RIPEMD160.patch \
            file://0001-rpmplugins.c-call-dlerror-prior-to-dlsym.patch \
+           file://0001-rpmio-Fix-lzopen_internal-mode-parsing-when-Tn-is-us.patch \
            file://CVE-2021-3421.patch \
            file://CVE-2021-20266.patch \
            "
-- 
2.25.1



  parent reply	other threads:[~2022-02-21 14:14 UTC|newest]

Thread overview: 23+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-02-21 14:13 [OE-core][dunfell 00/20] Patch review Steve Sakoman
2022-02-21 14:13 ` [OE-core][dunfell 01/20] expat: fix CVE-2022-23990 Steve Sakoman
2022-02-21 14:14 ` [OE-core][dunfell 02/20] connman: fix CVE-2022-23096-7 Steve Sakoman
2022-02-21 14:14 ` [OE-core][dunfell 03/20] connman: fix CVE-2022-23098 Steve Sakoman
2022-02-21 14:14 ` [OE-core][dunfell 04/20] connman: fix CVE-2021-33833 Steve Sakoman
2022-02-21 14:14 ` [OE-core][dunfell 05/20] wpa-supplicant: fix CVE-2022-23303-4 Steve Sakoman
2022-02-21 14:14 ` [OE-core][dunfell 06/20] lighttpd: backport a fix for CVE-2022-22707 Steve Sakoman
2022-02-21 14:14 ` [OE-core][dunfell 07/20] binutils: Fix CVE-2021-45078 Steve Sakoman
2022-02-21 14:14 ` [OE-core][dunfell 08/20] freetype: add missing CVE tag CVE-2020-15999 Steve Sakoman
2022-02-21 14:14 ` [OE-core][dunfell 09/20] cve-check: create directory of CVE_CHECK_MANIFEST before copy Steve Sakoman
2022-02-21 14:14 ` [OE-core][dunfell 10/20] recipetool: Fix circular reference in SRC_URI Steve Sakoman
2022-02-21 14:14 ` [OE-core][dunfell 11/20] devtool: deploy-target: Remove stripped binaries in pseudo context Steve Sakoman
2022-02-21 14:14 ` Steve Sakoman [this message]
2022-02-21 14:14 ` [OE-core][dunfell 13/20] cmake: remove bogus CMAKE_LDFLAGS_FLAGS definition from toolchain file Steve Sakoman
2022-02-21 14:14 ` [OE-core][dunfell 14/20] linux-yocto/5.4: update to v5.4.173 Steve Sakoman
2022-02-21 14:14 ` [OE-core][dunfell 15/20] linux-yocto/5.4: update to v5.4.176 Steve Sakoman
2022-02-21 14:14 ` [OE-core][dunfell 16/20] linux-yocto/5.4: update to v5.4.178 Steve Sakoman
2022-02-21 14:14 ` [OE-core][dunfell 17/20] linux-firmware: upgrade 20211216 -> 20220209 Steve Sakoman
2022-02-21 14:14 ` [OE-core][dunfell 18/20] sdk: fix search for dynamic loader Steve Sakoman
2022-02-21 14:14 ` [OE-core][dunfell 19/20] default-distrovars.inc: Switch connectivity check to a yoctoproject.org page Steve Sakoman
2022-02-21 14:14 ` [OE-core][dunfell 20/20] ruby: correctly set native/target dependencies Steve Sakoman
2022-02-21 14:17   ` Konrad Weihmann
2022-02-21 14:32     ` Steve Sakoman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=b093005d31467d89b00af621f86eb5cac7f845af.1645452535.git.steve@sakoman.com \
    --to=steve@sakoman.com \
    --cc=openembedded-core@lists.openembedded.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.