bryson/pacman
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fetch signature and database from the same URL

Browse source 
Previously, the for loops on lines 1035 and 1037 would advance to the
next element in the server list, even if downloading the URL succeeded.
If there are no more servers in the list, `s` would be NULL, causing
a NULL pointer dereference on line 1046.  If there were servers left
in the list, the signature would be downloaded from a wrong URL.

1. Fetching of database signatures is enabled.
2. There is only one enabled remote repository URL, or fetching from
   all but the last one fails and fetching from the last one succeeds.
3. An XferCommand is used.

Qubes OS Arch templates satisfy all of these conditions and trigger the bug.
This commit is contained in:
Demi Obenour 2024-03-17 16:05:55 +00:00 • committed by Allan McRae
parent 478af5d1c8
commit eb5bf69138
1 changed files with 9 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
lib/libalpm/dload.c
View file

@ -1032,13 +1032,20 @@ int _alpm_download(alpm_handle_t *handle,
}
}
} else {
for(s = payload->cache_servers; s && ret == -1; s = s->next) {
for(s = payload->cache_servers; s; s = s->next) {
ret = payload_download_fetchcb(payload, s->data, localpath);
if (ret != -1) {
goto download_signature;
}
}
for(s = payload->servers; s && ret == -1; s = s->next) {
for(s = payload->servers; s; s = s->next) {
ret = payload_download_fetchcb(payload, s->data, localpath);
if (ret != -1) {
goto download_signature;
}
}
download_signature:
if (ret != -1 && payload->download_signature) {
/* Download signature if requested */
char *sig_fileurl;