- fix invalid memory access causing bogus file dependency errors (#506323)

rpm-4.7.0-fp-findbyfile.patch

@@ -0,0 +1,105 @@
+diff --git a/lib/fprint.c b/lib/fprint.c
+index e57ba20..c56b0e5 100644
+--- a/lib/fprint.c
++++ b/lib/fprint.c
+@@ -37,8 +37,10 @@ fingerPrintCache fpCacheCreate(int sizeHint)
+ 
+ fingerPrintCache fpCacheFree(fingerPrintCache cache)
+ {
+-    cache->ht = rpmFpEntryHashFree(cache->ht);
+-    free(cache);
++    if (cache) {
++	cache->ht = rpmFpEntryHashFree(cache->ht);
++	free(cache);
++    }
+     return NULL;
+ }
+ 
+diff --git a/lib/rpmdb.c b/lib/rpmdb.c
+index 439a974..d76630e 100644
+--- a/lib/rpmdb.c
++++ b/lib/rpmdb.c
+@@ -1098,20 +1098,20 @@ int rpmdbVerify(const char * prefix)
+ static int rpmdbFindByFile(rpmdb db, const char * filespec,
+ 		DBT * key, DBT * data, dbiIndexSet * matches)
+ {
+-    char * dirName;
++    char * dirName = NULL;
+     const char * baseName;
+-    fingerPrintCache fpc;
++    fingerPrintCache fpc = NULL;
+     fingerPrint fp1;
+     dbiIndex dbi = NULL;
+     DBC * dbcursor;
+     dbiIndexSet allMatches = NULL;
+     dbiIndexItem rec = NULL;
+     unsigned int i;
+-    int rc;
++    int rc = -2; /* assume error */
+     int xx;
+ 
+     *matches = NULL;
+-    if (filespec == NULL) return -2;
++    if (filespec == NULL) return rc; /* nothing alloced yet */
+ 
+     if ((baseName = strrchr(filespec, '/')) != NULL) {
+ 	size_t len = baseName - filespec + 1;
+@@ -1123,11 +1123,7 @@ static int rpmdbFindByFile(rpmdb db, const char * filespec,
+ 	baseName = filespec;
+     }
+     if (baseName == NULL)
+-	return -2;
+-
+-    fpc = fpCacheCreate(20);
+-    fp1 = fpLookup(fpc, dirName, baseName, 1);
+-    free(dirName);
++	goto exit;
+ 
+     dbi = dbiOpen(db, RPMTAG_BASENAMES, 0);
+     if (dbi != NULL) {
+@@ -1154,16 +1150,14 @@ static int rpmdbFindByFile(rpmdb db, const char * filespec,
+     } else
+ 	rc = -2;
+ 
+-    if (rc) {
+-	allMatches = dbiFreeIndexSet(allMatches);
+-	fpc = fpCacheFree(fpc);
+-	return rc;
+-    }
++    if (rc || allMatches == NULL) goto exit;
+ 
+     *matches = xcalloc(1, sizeof(**matches));
+     rec = dbiIndexNewItem(0, 0);
++    fpc = fpCacheCreate(allMatches->count);
++    fp1 = fpLookup(fpc, dirName, baseName, 1);
++
+     i = 0;
+-    if (allMatches != NULL)
+     while (i < allMatches->count) {
+ 	struct rpmtd_s bn, dn, di;
+ 	const char ** baseNames, ** dirNames;
+@@ -1216,16 +1210,19 @@ static int rpmdbFindByFile(rpmdb db, const char * filespec,
+     }
+ 
+     rec = _free(rec);
+-    allMatches = dbiFreeIndexSet(allMatches);
+-
+-    fpc = fpCacheFree(fpc);
++    fpCacheFree(fpc);
+ 
+     if ((*matches)->count == 0) {
+ 	*matches = dbiFreeIndexSet(*matches);
+-	return 1;
++	rc = 1;
++    } else {
++	rc = 0;
+     }
+ 
+-    return 0;
++exit:
++    dbiFreeIndexSet(allMatches);
++    free(dirName);
++    return rc;
+ }
+ 
+ /* XXX python/upgrade.c, install.c, uninstall.c */

rpm.spec

@@ -46,6 +46,7 @@ Patch203: rpm-4.7.0-hardlink-sizes.patch
 Patch204: rpm-4.7.0-dwarf3.patch
 Patch205: rpm-4.7.0-osgideps.patch
 Patch206: rpm-4.7.0-fp-symlink.patch
+Patch207: rpm-4.7.0-fp-findbyfile.patch
 
 # These are not yet upstream
 Patch300: rpm-4.7.0-extra-provides.patch
@@ -205,6 +206,7 @@ packages on a system.
 %patch204 -p1 -b .dwarf3
 %patch205 -p1 -b .osgideps
 %patch206 -p1 -b .fp-symlink
+%patch207 -p1 -b .fp-findbyfile
 
 %patch300 -p1 -b .extra-prov
 %patch301 -p1 -b .niagara
@@ -422,6 +424,7 @@ exit 0
 * Thu Jun 18 2009 Panu Matilainen <pmatilai@redhat.com> - 4.7.0-8
 - updated OSGi dependency extractor (#506471)
 - fix segfault in symlink fingerprinting (#505777)
+- fix invalid memory access causing bogus file dependency errors (#506323)
 
 * Tue Jun 16 2009 Panu Matilainen <pmatilai@redhat.com> - 4.7.0-7
 - add dwarf-3 support to debugedit (#505774)