From 66aef0877e81c9ce4fee3c1b6e9f7e4846d97d97 Mon Sep 17 00:00:00 2001 From: Romain Geissler Date: Fri, 7 Mar 2025 00:24:54 +0000 Subject: [PATCH] Fix input termination for pgpParsePkts Resolves: RHEL-82533 --- ...x-input-termination-for-pgpParsePkts.patch | 42 +++++++++++++++++++ librepo.spec | 8 +++- 2 files changed, 49 insertions(+), 1 deletion(-) create mode 100644 0004-Fix-input-termination-for-pgpParsePkts.patch diff --git a/0004-Fix-input-termination-for-pgpParsePkts.patch b/0004-Fix-input-termination-for-pgpParsePkts.patch new file mode 100644 index 0000000..8db56f7 --- /dev/null +++ b/0004-Fix-input-termination-for-pgpParsePkts.patch @@ -0,0 +1,42 @@ +From 06f979fc87ca16046df0a9117ef1ca8c1751135c Mon Sep 17 00:00:00 2001 +From: Jaroslav Rohel +Date: Wed, 2 Oct 2024 10:00:34 +0200 +Subject: [PATCH] Fix input termination for pgpParsePkts + +The `pgpParsePkts` function needs the OpenPGP ASCII armored input to be +null terminated. The librepo contains code that checks if the input is +null-terminated. If it is not, the code creates a local null-terminated +copy of the input. + +There was a bug in the code, so it may look for a terminating null +several bytes behind the input buffer. And when a null was found behind +the input buffer, the termination was not done. This caused +the `pgpParsePkts` function to process several extra characters after +the input buffer. These characters are generally random and sometimes +cause the `pgpParsePkts` function to return an error. +--- + librepo/gpg_rpm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/librepo/gpg_rpm.c b/librepo/gpg_rpm.c +index a1613ee8..692c64ec 100644 +--- a/librepo/gpg_rpm.c ++++ b/librepo/gpg_rpm.c +@@ -350,7 +350,7 @@ lr_gpg_import_key_from_memory(const char *key, size_t key_len, const char *home_ + + // `pgpParsePkts` needs null-terminated input, if null byte not found, make a local null-terminated copy + g_autofree gchar * key_with_null_byte = NULL; +- if (memchr(block_begin, '\0', key_len) == NULL) { ++ if (memchr(block_begin, '\0', key_len - (block_begin - key)) == NULL) { + key_with_null_byte = g_new(gchar, key_len + 1); + memcpy(key_with_null_byte, key, key_len); + key_with_null_byte[key_len] = '\0'; +@@ -533,7 +533,7 @@ check_signature(const gchar * sig_buf, ssize_t sig_buf_len, const gchar * data, + + // `pgpParsePkts` needs null-terminated input, if null byte not found, make a local null-terminated copy + g_autofree gchar * sig_buf_with_null_byte = NULL; +- if (memchr(block_begin, '\0', sig_buf_len) == NULL) { ++ if (memchr(block_begin, '\0', sig_buf_len - (block_begin - sig_buf)) == NULL) { + sig_buf_with_null_byte = g_new(gchar, sig_buf_len + 1); + memcpy(sig_buf_with_null_byte, sig_buf, sig_buf_len); + sig_buf_with_null_byte[sig_buf_len] = '\0'; diff --git a/librepo.spec b/librepo.spec index bb4a57c..6f22d36 100644 --- a/librepo.spec +++ b/librepo.spec @@ -29,7 +29,7 @@ Name: librepo Version: 1.18.0 -Release: 4%{?dist} +Release: 5%{?dist} Summary: Repodata downloading library License: LGPL-2.1-or-later @@ -38,6 +38,8 @@ Source0: %{url}/archive/%{version}/%{name}-%{version}.tar.gz Patch1: 0001-Use-rpm-sequoia-on-RHEL-10.patch Patch2: 0002-Fix-a-memory-leak-in-select_next_target.patch Patch3: 0003-Propagate-return-value-from-prepare_repo_download_ta.patch +# https://github.com/rpm-software-management/librepo/pull/325 +Patch4: 0004-Fix-input-termination-for-pgpParsePkts.patch BuildRequires: cmake BuildRequires: gcc @@ -130,6 +132,10 @@ Python 3 bindings for the librepo library. %{python3_sitearch}/%{name}/ %changelog +* Tue Jun 24 2025 Romain Geissler - 1.18.0-5 +- Fix input termination for pgpParsePkts + Resolves: RHEL-82533 + * Tue Jun 24 2025 Ales Matej - 1.18.0-4 - Propagate return value from prepare_repo_download_targets (RHEL-85338)