Cap the maximum array/object size to ADBI_MAX. Anything larger
would not fit a valid ADB blob, and could cause size_t calculation
overflow for memory allocation on 32-bit architectures. This code
path is not reacahable without a signed and trusted file.
A crafted file might cause an OOB read beyond source buffer.
Typically this is in the uncompression buffer, and would not
cause a crash. Seems there is no immediate place in the callers
that would crash either, but update some of the callers to make
this more obivous and return more approriate error codes.
Make sure that the parent directory is a real directory extracted
and processed earlier for symlinks. And that the hardlink target
is a previously processed regular file.
Fix setting uid/gid bit for directories: it needs a separate follow
up fchmodat() as these bits are ignored for the mkdirat() call.
Also always use AT_SYMLINK_NOFOLLOW bit to not follow symlinks
for these operations. Typically this is not a problem unless
the user has done incomptile changes to the apk managed file system.
fixes#11216fixes#11217
The armhf binary has not been built since commit aa245e7002
"ci: test on more cpu architectures" which refactored the pipelines.
While removal of armhf release binary seems to have been accidental,
there seems to have been no use for it and most sensible arm platforms
now run armv7 binaries, so let's remove this now.
fixes#11214
MAX_ADDRESS_STRING was 4*8+1 = 33 characters, but an IPv6 literal in
full form runs to 45 characters plus the terminator. host_to_address()
rejects any address that does not fit, so no_proxy CIDR entries
silently failed to match a host written in full form.
Use INET6_ADDRSTRLEN, which is the constant meant for this.
Signed-off-by: Tobias Koch <tobias.koch@aeltra.eu>
Two leaks of the "new" URL:
- A second Location header in the same reply released the previous
allocation with free() rather than fetchFreeURL(), leaking new->doc.
- Any error between parsing a Location header and consuming it at the
bottom of the retry loop -- a malformed Content-Length, say --
reaches the ouch label, which never released new at all.
Use fetchFreeURL() in the first case and release new at the ouch label
in the second. The label is reached both before and after the loop
assigns new to url, so the release there is guarded against the alias.
Signed-off-by: Tobias Koch <tobias.koch@aeltra.eu>
src is a char pointer, so on platforms where char is signed -- x86-64
among them -- every input byte >= 0x80 sign-extends when shifted into t
and floods the high bits, corrupting the whole four-character group.
Encoding "caf\xc3\xa9" then yields "Y2Fm/6k=" instead of "Y2Fmw6k=", so
Basic credentials containing any non-ASCII byte are sent wrong.
Platforms where char is unsigned (arm, aarch64, ppc) are unaffected,
which is why this goes unnoticed on a good part of the build farm.
Convert through unsigned char before shifting.
Signed-off-by: Tobias Koch <tobias.koch@aeltra.eu>
last_conn was initialised to NULL and never advanced, so the branch
that unlinks a matched entry from the middle of the list was
unreachable. A cache hit on any entry but the first therefore ran
"connection_cache = conn->next_cached", dropping every entry ahead of
the match from the list without closing it and leaking its descriptor,
SSL context and buffers.
Advance last_conn as the list is walked.
Signed-off-by: Tobias Koch <tobias.koch@aeltra.eu>
HTTP_ERROR() excluded both ends of its intended range, so 400 (Bad
Request) and 599 counted as neither success nor error.
http_request() only reaches the macro for an error status when the 'v'
flag is set; without it the status-line switch has already taken
"if (!verbose) goto ouch". With 'v', a 400 or 599 instead takes the
branch commented "all other cases: we got a redirect". No redirect is
actually followed there, since hdr_location only sets "new" for a
status matching HTTP_REDIRECT(), and the reply is still reported as an
error via the http_seterr() in the switch. But the connection is
closed outright instead of being drained and returned to the connection
cache, and the caller's url_stat is left unfilled.
Use the conventional 4xx-5xx range.
Signed-off-by: Tobias Koch <tobias.koch@aeltra.eu>
Both functions return ssize_t, and returning EBADF returns a positive
9 -- which a caller reads as "9 bytes transferred" rather than as an
error. A reader looping while the result is > 0 would treat 9 bytes of
uninitialised buffer as payload.
Set errno and return -1, matching the convention of the read/write
callbacks these functions wrap.
Signed-off-by: Tobias Koch <tobias.koch@aeltra.eu>
fetchIO_write() guarded on f->io_read before calling through
f->io_write, so a fetchIO created with a read callback but no write
callback would dereference a NULL function pointer.
Signed-off-by: Tobias Koch <tobias.koch@aeltra.eu>
The condition ran the getpwuid() fallback when $HOME was set, throwing
away the value it had just read, and skipped it when $HOME was unset --
leaving p NULL for the following snprintf("%s/.netrc", p).
Fall back to getpwuid() when $HOME is not set, as the surrounding code
intends.
Signed-off-by: Tobias Koch <tobias.koch@aeltra.eu>
When strdup() failed, the cleanup loop counted down over i but freed
dst->urls[j].doc on every iteration -- always the entry whose strdup()
had just failed, and therefore always NULL. The strings duplicated by
the preceding iterations were leaked.
Walk j back down to dst->length instead, which frees exactly the
entries that were successfully duplicated and stops before the one that
failed.
Signed-off-by: Tobias Koch <tobias.koch@aeltra.eu>
Commit d430a98976 ("libfetch: fix use-after-free in connection cache
management") hoisted next_cached out of the eviction loop so that the
walk no longer reads iter after the close callback has freed it. The
same increment expression still advances "last", however, and it runs
for entries that were just unlinked and handed to that callback.
"last" is therefore left pointing at freed memory, and the next
eviction writes through it via "last->next_cached = ...", corrupting
the connection cache.
Advance "last" only for entries that are retained.
Signed-off-by: Tobias Koch <tobias.koch@aeltra.eu>
fetch_bind() calls getaddrinfo() but never releases the returned list,
leaking it on both the success and the failure path.
Signed-off-by: Tobias Koch <tobias.koch@aeltra.eu>
Move the validation to tar.c and extract_v3.c to validate filename
before it reaches the consuming side. This implicitly fixes 'extract'
applet to also validate the filenames.
Also instead of just ignoring the malicious files treat the package
as being broken: abort further extraction, and during regular install
rollback instead of keeping it in 'broken' state.
fixes#11194fixes#11212
Add a genhelp_zsh.lua plugin alongside the existing bash generator,
producing a Zsh completion script (_apk) via a #compdef header and
_arguments/compadd-based dispatch, rather than the COMP_WORDS/COMPREPLY
mechanism Bash relies on.
Applet names are paired with their descriptions from apk.8.scd's
COMMANDS section for use with _describe. Per-applet flags are grouped
by alias (e.g. -h/--help) into single _arguments specs with their
first-sentence description from OPTIONS, following the same
first-sentence truncation genhelp_bash.lua already uses. Package name
completion is wired through __apk_installed_pkgs/__apk_available_pkgs
helper functions using compadd, mapped per applet the same way the
bash plugin's wildcard table is.
Wire the new plugin into the build as a second custom_target in
src/meson.build, installed to zsh/site-functions. The build-time
output is named _apk_zsh to avoid colliding with the existing bash
target's _apk output in the build tree; it is installed as _apk,
which Zsh's compinit discovers via the #compdef directive rather
than a filename convention, so no build-time renaming is required.
This addresses the gap discussed upstream in apk-tools!44 and
alpine/aports!14571, where Zsh completions exist only as a
hand-maintained, unversioned copy in aports rather than being
generated from the same source of truth as the Bash completions
and built-in help.
Previously only '--format=bash' was recognized; any other value fell
through to the input-file branch and was passed to doc:parse(), which
fails since it isn't a filename. Accept '--format=<name>' generically
so additional output plugins (e.g. genhelp_zsh.lua) can be selected
the same way.
If Lua zlib module is not available, genhelp falls back to `gzip`, which embeds
the MTIME. As a result the created `apk` binary is unreproducible.
This commits passes `-n` so gzip omits the original MTIME and sets it to 0
instead.
Signed-off-by: Paul Spooren <mail@aparcar.org>
Fix open_repository[] size to PATH_MAX as full URLs are needed
there. Rename the cache filename buffers that are NAME_MAX length
to _filename to indicate that they have only filename portion.
fixes#11196
aphrody-dev
Timo Teräs