[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#773256: marked as done (pre-approval: unblock: dpkg/1.17.23)



Your message dated Tue, 06 Jan 2015 21:16:51 +0100
with message-id <54AC42B3.5030000@thykier.net>
and subject line Re: Bug#773256: pre-approval: unblock: dpkg/1.17.23
has caused the Debian Bug report #773256,
regarding pre-approval: unblock: dpkg/1.17.23
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
773256: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773256
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
User: release.debian.org@packages.debian.org
Usertags: unblock
Control: block -1 by 770627

Hi!

I'd like to upload dpkg 1.17.23 with the following changes. I've
excluded and filtered translation changes. I'm including a patch series
instead of a debdiff, because it should be clearer and easier to spot
specific changes you might not want to approve?

I'd prefer if 1.17.22 could be unblocked before uploading this, because
that version is way better than the one currently in testing, and it is
causing fewer upgrade issues. Otherwise I'll just merge both unblock
requests.

I've delayed a bit the request because there are still some packages
with trigger cycles that have not been uploaded yet, I can start taking
a look on delayed NMUs and wait for those or upload .23 right away and
possibly prepare a .24 with those additional versioned Breaks, whichever
you prefer.

I've also not added the --force-configure-any default switch, because we
don't really know what happened with apt and dbus there, and if apt from
stable is affected or not. Given the recent dpkg, apt, and dbus changes
I think I'd rather let this as is, and wait in case it shows up again,
which should give us more information (due to the new apt not eating
dpkg's output).

Here's the full tentative changelog (with the translation changes
already in master):

,---
dpkg (1.17.23) UNRELEASED; urgency=low

  [ Guillem Jover ]
  * Use a matching group instead of ${^MATCH} in s/// in dselect build script.
  * Skip tar extractor tests if tar is not GNU tar >= 1.27.
  * Reset the trigger cycle tracking on unsatisfied dependencies.
    Closes: #771730
  * Fix out-of-bounds buffer read accesses when parsing field and trigger
    names or checking package ownership of conffiles and directories.
    Reported by Joshua Rogers <megamansec@gmail.com>.
  * Add versioned Breaks on packages creating trigger cycles. Namely
    apt-cudf, ccache, cups, distcc, fusionforge-plugin-mediawiki, gap-core,
    hoogle, libjs-protoaculous and xfonts-traditional.

  [ Updated programs translations ]
  * Basque (Iñaki Larrañaga Murgoitio). Closes: #771893
  * Catalan (Guillem Jover).
  * Czech (Miroslav Kure).
  * Esperanto (Felipe Castro).
  * French (Sébastien Poher).
  * Italian (Milo Casagrande).
  * Swedish (Peter Krefting).
  * Portuguese (Miguel Figueiredo).
  * Russian (Yuri Kozlov). Closes: #771691
  * Simplified Chinese (Zhou Mo). Closes: #771264
  * Spanish (Javier Fernández-Sanguino)
  * Thai (Theppitak Karoonboonyanan). Closes: #772965

  [ Updated scripts translations ]
  * Catalan (Guillem Jover).
  * Polish (Łukasz Dulny).
  * Russian (Yuri Kozlov). Closes: #772841

  [ Updated manpages translations ]
  * French (Sébastien Poher).
  * Italian (Beatrice Torracca). Closes: #771673

  [ Updated dselect translations ]
  * Catalan (Guillem Jover).
  * Czech (Miroslav Kure).
  * Norwegian Bokmål (Hans Fredrik Nordhaug).
  * Polish (Łukasz Dulny).
  * Portuguese (Miguel Figueiredo).
  * Russian (Yuri Kozlov). Closes: #771682
  * Spanish (Javier Fernández-Sanguino)
  * Vietnamese (Trần Ngọc Quân).

 -- Guillem Jover <guillem@debian.org>  Fri, 28 Nov 2014 02:41:17 +0100
`---

Thanks,
Guillem
From a5d6590b7a2a9f649f5aab01e3410bac62e12a76 Mon Sep 17 00:00:00 2001
From: Guillem Jover <guillem@debian.org>
Date: Fri, 5 Dec 2014 23:29:03 +0100
Subject: [PATCH 1/5] dselect: Use a matching group instead of ${^MATCH} in
 s///

It seems that this is not supported or does not work in perl 5.14.0,
although it should be since 5.10.0. Switch to a group matching to
allow using older perl version from stable.
---
 debian/changelog     | 3 +++
 dselect/mkcurkeys.pl | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/debian/changelog b/debian/changelog
index 432d705..0ff1d9b 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,5 +1,8 @@
 dpkg (1.17.23) UNRELEASED; urgency=low
 
+  [ Guillem Jover ]
+  * Use a matching group instead of ${^MATCH} in s/// in dselect build script.
+
   [ Updated programs translations ]
   * Basque (Iñaki Larrañaga Murgoitio). Closes: #771893
   * Catalan (Guillem Jover).
diff --git a/dselect/mkcurkeys.pl b/dselect/mkcurkeys.pl
index d859376..342d491 100755
--- a/dselect/mkcurkeys.pl
+++ b/dselect/mkcurkeys.pl
@@ -140,6 +140,6 @@ sub capit {
 sub p {
     my ($k, $v) = @_;
 
-    $v =~ s/["\\]/\\${^MATCH}/pg;
+    $v =~ s/(["\\])/\\$1/g;
     printf("  { %-15s \"%-20s },\n", $k . ',', $v . '"') or die $!;
 }
-- 
2.2.0.rc0.207.ga3a616c

From 88999a73fc4d77b3ab1072f3102cfbeaff94ab31 Mon Sep 17 00:00:00 2001
From: Guillem Jover <guillem@debian.org>
Date: Sat, 6 Dec 2014 00:11:14 +0100
Subject: [PATCH 2/5] libdpkg: Skip tar extractor tests if tar is not GNU tar
 >= 1.27

This allows building on older systems.
---
 debian/changelog      |  1 +
 lib/dpkg/test/t-tar.t | 13 ++++++++++++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/debian/changelog b/debian/changelog
index 0ff1d9b..da54d81 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -2,6 +2,7 @@ dpkg (1.17.23) UNRELEASED; urgency=low
 
   [ Guillem Jover ]
   * Use a matching group instead of ${^MATCH} in s/// in dselect build script.
+  * Skip tar extractor tests if tar is not GNU tar >= 1.27.
 
   [ Updated programs translations ]
   * Basque (Iñaki Larrañaga Murgoitio). Closes: #771893
diff --git a/lib/dpkg/test/t-tar.t b/lib/dpkg/test/t-tar.t
index 4ad62e7..69eaf5c 100755
--- a/lib/dpkg/test/t-tar.t
+++ b/lib/dpkg/test/t-tar.t
@@ -15,7 +15,7 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
-use Test::More tests => 12;
+use Test::More;
 use Cwd;
 use File::Path qw(make_path remove_tree);
 use File::Temp qw(tempdir);
@@ -27,11 +27,22 @@ use Dpkg::IPC;
 
 use strict;
 use warnings;
+use version;
 
 my $srcdir = $ENV{srcdir} || '.';
 my $builddir = $ENV{builddir} || '.';
 my $tmpdir = 't.tmp/t-tar';
 
+# We require GNU tar >= 1.27 for --owner=NAME:ID and --group=NAME:ID.
+my $tar_version = qx(tar --version 2>/dev/null);
+if ($tar_version and $tar_version =~ m/^tar \(GNU tar\) (\d+\.\d+)/ and
+    qv("v$1") >= qv('v1.27'))
+{
+    plan tests => 12;
+} else {
+    plan skip_all => 'needs GNU tar >= 1.27';
+}
+
 # Set a known umask.
 umask 0022;
 
-- 
2.2.0.rc0.207.ga3a616c

From d225f442edabf12da28c5021b89a56db044a1d08 Mon Sep 17 00:00:00 2001
From: Guillem Jover <guillem@debian.org>
Date: Fri, 5 Dec 2014 09:41:00 +0100
Subject: [PATCH 3/5] dpkg: Reset the trigger cycle tracking on unsatisfied
 dependencies

If we are not going to process triggers due to an unsatisfied
dependency, we should reset the trigger cycle tracking information
so that we do not end up reporting bogus cycle errors.

Closes: #771730
---
 debian/changelog | 2 ++
 src/trigproc.c   | 7 +++++++
 2 files changed, 9 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index da54d81..98c1844 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -3,6 +3,8 @@ dpkg (1.17.23) UNRELEASED; urgency=low
   [ Guillem Jover ]
   * Use a matching group instead of ${^MATCH} in s/// in dselect build script.
   * Skip tar extractor tests if tar is not GNU tar >= 1.27.
+  * Reset the trigger cycle tracking on unsatisfied dependencies.
+    Closes: #771730
 
   [ Updated programs translations ]
   * Basque (Iñaki Larrañaga Murgoitio). Closes: #771893
diff --git a/src/trigproc.c b/src/trigproc.c
index ea91c74..bb17346 100644
--- a/src/trigproc.c
+++ b/src/trigproc.c
@@ -385,6 +385,13 @@ trigproc(struct pkginfo *pkg, enum trigproc_type type)
 			enqueue_package(pkg);
 			return;
 		} else if (ok == DEP_CHECK_HALT) {
+			/* We cannot process this package on this dpkg run,
+			 * and we can get here repeatedly if this package is
+			 * required to make progress for other packages. So
+			 * reset the trigger cycles tracking to avoid bogus
+			 * cycle detections. */
+			trigproc_reset_cycle();
+
 			/* When doing opportunistic trigger processig, nothing
 			 * requires us to be able to make progress; skip the
 			 * package and silently ignore the error due to
-- 
2.2.0.rc0.207.ga3a616c

From dbe0913e1ffba0665bb6ce1b1dc03d4851bec8f1 Mon Sep 17 00:00:00 2001
From: Guillem Jover <guillem@debian.org>
Date: Sat, 29 Nov 2014 15:56:15 +0100
Subject: [PATCH 4/5] libdpkg, dpkg: Fix out-of-bounds read accesses

Limit the buffer accesses to the size of the buffer being accessed. This
affects reads done when parsing field and trigger names, or checking the
package ownership of conffiles and directories.

Use a new length member for struct fieldinfo and nickname to avoid
recomputing the same known length over and over again, but use strlen()
instead for arbitrary fields, conffiles and directories to avoid
increaseing the memory footprint too much.

Reported-by: Joshua Rogers <megamansec@gmail.com>
---
 debian/changelog      |  3 ++
 lib/dpkg/parse.c      | 84 +++++++++++++++++++++++++--------------------------
 lib/dpkg/parsedump.h  |  6 ++++
 lib/dpkg/pkg-format.c | 16 +++++-----
 lib/dpkg/triglib.c    |  4 +--
 src/help.c            |  3 +-
 6 files changed, 63 insertions(+), 53 deletions(-)

diff --git a/debian/changelog b/debian/changelog
index 98c1844..2d6b2e0 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -5,6 +5,9 @@ dpkg (1.17.23) UNRELEASED; urgency=low
   * Skip tar extractor tests if tar is not GNU tar >= 1.27.
   * Reset the trigger cycle tracking on unsatisfied dependencies.
     Closes: #771730
+  * Fix out-of-bounds buffer read accesses when parsing field and trigger
+    names or checking package ownership of conffiles and directories.
+    Reported by Joshua Rogers <megamansec@gmail.com>.
 
   [ Updated programs translations ]
   * Basque (Iñaki Larrañaga Murgoitio). Closes: #771893
diff --git a/lib/dpkg/parse.c b/lib/dpkg/parse.c
index 604e7ad..d70d3f0 100644
--- a/lib/dpkg/parse.c
+++ b/lib/dpkg/parse.c
@@ -52,49 +52,49 @@
  */
 const struct fieldinfo fieldinfos[]= {
   /* Note: Capitalization of field name strings is important. */
-  { "Package",          f_name,            w_name                                     },
-  { "Essential",        f_boolean,         w_booleandefno,   PKGIFPOFF(essential)     },
-  { "Status",           f_status,          w_status                                   },
-  { "Priority",         f_priority,        w_priority                                 },
-  { "Section",          f_section,         w_section                                  },
-  { "Installed-Size",   f_charfield,       w_charfield,      PKGIFPOFF(installedsize) },
-  { "Origin",           f_charfield,       w_charfield,      PKGIFPOFF(origin)        },
-  { "Maintainer",       f_charfield,       w_charfield,      PKGIFPOFF(maintainer)    },
-  { "Bugs",             f_charfield,       w_charfield,      PKGIFPOFF(bugs)          },
-  { "Architecture",     f_architecture,    w_architecture                             },
-  { "Multi-Arch",       f_multiarch,       w_multiarch,      PKGIFPOFF(multiarch)     },
-  { "Source",           f_charfield,       w_charfield,      PKGIFPOFF(source)        },
-  { "Version",          f_version,         w_version,        PKGIFPOFF(version)       },
-  { "Revision",         f_revision,        w_null                                     },
-  { "Config-Version",   f_configversion,   w_configversion                            },
-  { "Replaces",         f_dependency,      w_dependency,     dep_replaces             },
-  { "Provides",         f_dependency,      w_dependency,     dep_provides             },
-  { "Depends",          f_dependency,      w_dependency,     dep_depends              },
-  { "Pre-Depends",      f_dependency,      w_dependency,     dep_predepends           },
-  { "Recommends",       f_dependency,      w_dependency,     dep_recommends           },
-  { "Suggests",         f_dependency,      w_dependency,     dep_suggests             },
-  { "Breaks",           f_dependency,      w_dependency,     dep_breaks               },
-  { "Conflicts",        f_dependency,      w_dependency,     dep_conflicts            },
-  { "Enhances",         f_dependency,      w_dependency,     dep_enhances             },
-  { "Conffiles",        f_conffiles,       w_conffiles                                },
-  { "Filename",         f_filecharf,       w_filecharf,      FILEFOFF(name)           },
-  { "Size",             f_filecharf,       w_filecharf,      FILEFOFF(size)           },
-  { "MD5sum",           f_filecharf,       w_filecharf,      FILEFOFF(md5sum)         },
-  { "MSDOS-Filename",   f_filecharf,       w_filecharf,      FILEFOFF(msdosname)      },
-  { "Description",      f_charfield,       w_charfield,      PKGIFPOFF(description)   },
-  { "Triggers-Pending", f_trigpend,        w_trigpend                                 },
-  { "Triggers-Awaited", f_trigaw,          w_trigaw                                   },
+  { FIELD("Package"),          f_name,            w_name                                     },
+  { FIELD("Essential"),        f_boolean,         w_booleandefno,   PKGIFPOFF(essential)     },
+  { FIELD("Status"),           f_status,          w_status                                   },
+  { FIELD("Priority"),         f_priority,        w_priority                                 },
+  { FIELD("Section"),          f_section,         w_section                                  },
+  { FIELD("Installed-Size"),   f_charfield,       w_charfield,      PKGIFPOFF(installedsize) },
+  { FIELD("Origin"),           f_charfield,       w_charfield,      PKGIFPOFF(origin)        },
+  { FIELD("Maintainer"),       f_charfield,       w_charfield,      PKGIFPOFF(maintainer)    },
+  { FIELD("Bugs"),             f_charfield,       w_charfield,      PKGIFPOFF(bugs)          },
+  { FIELD("Architecture"),     f_architecture,    w_architecture                             },
+  { FIELD("Multi-Arch"),       f_multiarch,       w_multiarch,      PKGIFPOFF(multiarch)     },
+  { FIELD("Source"),           f_charfield,       w_charfield,      PKGIFPOFF(source)        },
+  { FIELD("Version"),          f_version,         w_version,        PKGIFPOFF(version)       },
+  { FIELD("Revision"),         f_revision,        w_null                                     },
+  { FIELD("Config-Version"),   f_configversion,   w_configversion                            },
+  { FIELD("Replaces"),         f_dependency,      w_dependency,     dep_replaces             },
+  { FIELD("Provides"),         f_dependency,      w_dependency,     dep_provides             },
+  { FIELD("Depends"),          f_dependency,      w_dependency,     dep_depends              },
+  { FIELD("Pre-Depends"),      f_dependency,      w_dependency,     dep_predepends           },
+  { FIELD("Recommends"),       f_dependency,      w_dependency,     dep_recommends           },
+  { FIELD("Suggests"),         f_dependency,      w_dependency,     dep_suggests             },
+  { FIELD("Breaks"),           f_dependency,      w_dependency,     dep_breaks               },
+  { FIELD("Conflicts"),        f_dependency,      w_dependency,     dep_conflicts            },
+  { FIELD("Enhances"),         f_dependency,      w_dependency,     dep_enhances             },
+  { FIELD("Conffiles"),        f_conffiles,       w_conffiles                                },
+  { FIELD("Filename"),         f_filecharf,       w_filecharf,      FILEFOFF(name)           },
+  { FIELD("Size"),             f_filecharf,       w_filecharf,      FILEFOFF(size)           },
+  { FIELD("MD5sum"),           f_filecharf,       w_filecharf,      FILEFOFF(md5sum)         },
+  { FIELD("MSDOS-Filename"),   f_filecharf,       w_filecharf,      FILEFOFF(msdosname)      },
+  { FIELD("Description"),      f_charfield,       w_charfield,      PKGIFPOFF(description)   },
+  { FIELD("Triggers-Pending"), f_trigpend,        w_trigpend                                 },
+  { FIELD("Triggers-Awaited"), f_trigaw,          w_trigaw                                   },
   /* Note that aliases are added to the nicknames table. */
   {  NULL                                                                             }
 };
 
 static const struct nickname nicknames[] = {
   /* Note: Capitalization of these strings is important. */
-  { .nick = "Recommended",      .canon = "Recommends" },
-  { .nick = "Optional",         .canon = "Suggests" },
-  { .nick = "Class",            .canon = "Priority" },
-  { .nick = "Package-Revision", .canon = "Revision" },
-  { .nick = "Package_Revision", .canon = "Revision" },
+  { NICK("Recommended"),      .canon = "Recommends" },
+  { NICK("Optional"),         .canon = "Suggests" },
+  { NICK("Class"),            .canon = "Priority" },
+  { NICK("Package-Revision"), .canon = "Revision" },
+  { NICK("Package_Revision"), .canon = "Revision" },
   { .nick = NULL }
 };
 
@@ -122,8 +122,8 @@ pkg_parse_field(struct parsedb_state *ps, struct field_state *fs,
   int *ip;
 
   for (nick = nicknames; nick->nick; nick++)
-    if (strncasecmp(nick->nick, fs->fieldstart, fs->fieldlen) == 0 &&
-        nick->nick[fs->fieldlen] == '\0')
+    if (nick->nicklen == (size_t)fs->fieldlen &&
+        strncasecmp(nick->nick, fs->fieldstart, fs->fieldlen) == 0)
       break;
   if (nick->nick) {
     fs->fieldstart = nick->canon;
@@ -131,8 +131,8 @@ pkg_parse_field(struct parsedb_state *ps, struct field_state *fs,
   }
 
   for (fip = fieldinfos, ip = fs->fieldencountered; fip->name; fip++, ip++)
-    if (strncasecmp(fip->name, fs->fieldstart, fs->fieldlen) == 0 &&
-        fip->name[fs->fieldlen] == '\0')
+    if (fip->namelen == (size_t)fs->fieldlen &&
+        strncasecmp(fip->name, fs->fieldstart, fs->fieldlen) == 0)
       break;
   if (fip->name) {
     if ((*ip)++)
@@ -154,7 +154,7 @@ pkg_parse_field(struct parsedb_state *ps, struct field_state *fs,
     larpp = &pkg_obj->pkgbin->arbs;
     while ((arp = *larpp) != NULL) {
       if (strncasecmp(arp->name, fs->fieldstart, fs->fieldlen) == 0 &&
-          arp->name[fs->fieldlen] == '\0')
+          strlen(arp->name) == (size_t)fs->fieldlen)
         parse_error(ps,
                    _("duplicate value for user-defined field `%.*s'"),
                    fs->fieldlen, fs->fieldstart);
diff --git a/lib/dpkg/parsedump.h b/lib/dpkg/parsedump.h
index 9387a3e..4b8f8f6 100644
--- a/lib/dpkg/parsedump.h
+++ b/lib/dpkg/parsedump.h
@@ -120,8 +120,11 @@ void
 varbuf_add_arbfield(struct varbuf *vb, const struct arbitraryfield *arbfield,
                     enum fwriteflags flags);
 
+#define FIELD(name) name, sizeof(name) - 1
+
 struct fieldinfo {
   const char *name;
+  size_t namelen;
   freadfunction *rcall;
   fwritefunction *wcall;
   size_t integer;
@@ -142,9 +145,12 @@ void parse_ensure_have_field(struct parsedb_state *ps,
 
 #define MSDOS_EOF_CHAR '\032' /* ^Z */
 
+#define NICK(name) .nick = name, .nicklen = sizeof(name) - 1
+
 struct nickname {
   const char *nick;
   const char *canon;
+  size_t nicklen;
 };
 
 extern const struct fieldinfo fieldinfos[];
diff --git a/lib/dpkg/pkg-format.c b/lib/dpkg/pkg-format.c
index 19e8e1e..c914cbd 100644
--- a/lib/dpkg/pkg-format.c
+++ b/lib/dpkg/pkg-format.c
@@ -327,14 +327,14 @@ virt_source_version(struct varbuf *vb,
 }
 
 const struct fieldinfo virtinfos[] = {
-	{ "binary:Package", NULL, virt_package },
-	{ "binary:Summary", NULL, virt_summary },
-	{ "db:Status-Abbrev", NULL, virt_status_abbrev },
-	{ "db:Status-Want", NULL, virt_status_want },
-	{ "db:Status-Status", NULL, virt_status_status },
-	{ "db:Status-Eflag", NULL, virt_status_eflag },
-	{ "source:Package", NULL, virt_source_package },
-	{ "source:Version", NULL, virt_source_version },
+	{ FIELD("binary:Package"), NULL, virt_package },
+	{ FIELD("binary:Summary"), NULL, virt_summary },
+	{ FIELD("db:Status-Abbrev"), NULL, virt_status_abbrev },
+	{ FIELD("db:Status-Want"), NULL, virt_status_want },
+	{ FIELD("db:Status-Status"), NULL, virt_status_status },
+	{ FIELD("db:Status-Eflag"), NULL, virt_status_eflag },
+	{ FIELD("source:Package"), NULL, virt_source_package },
+	{ FIELD("source:Version"), NULL, virt_source_version },
 	{ NULL },
 };
 
diff --git a/lib/dpkg/triglib.c b/lib/dpkg/triglib.c
index 9acafd7..65b098b 100644
--- a/lib/dpkg/triglib.c
+++ b/lib/dpkg/triglib.c
@@ -337,9 +337,9 @@ trk_explicit_interest_change(const char *trig,  struct pkginfo *pkg,
 
 	while (trk_explicit_f && trk_explicit_fgets(buf, sizeof(buf)) >= 0) {
 		const char *pkgname = pkgbin_name(pkg, pkgbin, pnaw_nonambig);
-		int len = strlen(pkgname);
+		size_t len = strlen(pkgname);
 
-		if (strncmp(buf, pkgname, len) == 0 &&
+		if (strncmp(buf, pkgname, len) == 0 && len < sizeof(buf) &&
 		    (buf[len] == '\0' || buf[len] == '/'))
 			continue;
 		fprintf(file->fp, "%s\n", buf);
diff --git a/src/help.c b/src/help.c
index 3e83493..3a9b271 100644
--- a/src/help.c
+++ b/src/help.c
@@ -227,7 +227,7 @@ dir_has_conffiles(struct filenamenode *file, struct pkginfo *pkg)
       if (conff->obsolete)
         continue;
       if (strncmp(file->name, conff->name, namelen) == 0 &&
-          conff->name[namelen] == '/') {
+          strlen(conff->name) >= namelen && conff->name[namelen] == '/') {
 	debug(dbg_veryverbose, "directory %s has conffile %s from %s",
 	      file->name, conff->name, pkg_name(pkg, pnaw_always));
 	return true;
@@ -287,6 +287,7 @@ dir_is_used_by_pkg(struct filenamenode *file, struct pkginfo *pkg,
           node->namenode->name);
 
     if (strncmp(file->name, node->namenode->name, namelen) == 0 &&
+        strlen(node->namenode->name) >= namelen &&
         node->namenode->name[namelen] == '/') {
       debug(dbg_veryverbose, "dir_is_used_by_pkg yes");
       return true;
-- 
2.2.0.rc0.207.ga3a616c

From 7d63dac525dd4920c97a4c941e896306f4544886 Mon Sep 17 00:00:00 2001
From: Guillem Jover <guillem@debian.org>
Date: Thu, 11 Dec 2014 23:50:37 +0100
Subject: [PATCH 5/5] debian: Add versioned Breaks on packages creating trigger
 cycles

---
 debian/changelog | 3 +++
 debian/control   | 9 +++++++++
 2 files changed, 12 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index 2d6b2e0..b56ce25 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -8,6 +8,9 @@ dpkg (1.17.23) UNRELEASED; urgency=low
   * Fix out-of-bounds buffer read accesses when parsing field and trigger
     names or checking package ownership of conffiles and directories.
     Reported by Joshua Rogers <megamansec@gmail.com>.
+  * Add versioned Breaks on packages creating trigger cycles. Namely
+    apt-cudf, ccache, cups, distcc, fusionforge-plugin-mediawiki, gap-core,
+    hoogle, libjs-protoaculous and xfonts-traditional.
 
   [ Updated programs translations ]
   * Basque (Iñaki Larrañaga Murgoitio). Closes: #771893
diff --git a/debian/control b/debian/control
index 4653a47..b230b7c 100644
--- a/debian/control
+++ b/debian/control
@@ -37,8 +37,17 @@ Pre-Depends: ${shlibs:Depends}, tar (>= 1.23)
 Depends: ${misc:Depends}
 Breaks: dpkg-dev (<< 1.15.8), libdpkg-perl (<< 1.15.8),
 # These cause trigger cycles due to using awaiting trigger directives.
+ apt-cudf (<< 3.3~beta1-3),
+ ccache (<< 3.1.10-1),
+ cups (<< 1.7.5-10),
+ distcc (<< 3.1-6.1),
+ fusionforge-plugin-mediawiki (<< 5.3.2+20141104-3),
+ gap-core (<< 4r7p5-2),
+ hoogle (<< 4.2.33-4),
+ libjs-protoaculous (<< 5),
  man-db (<< 2.6.3-6), fontconfig (<< 2.11.0-6.2),
  readahead-fedora (<< 2:1.5.6-5.2),
+ xfonts-traditional (<< 1.7),
 # These do not support triggers.
  apt (<< 0.7.7), aptitude (<< 0.4.7-1)
 Conflicts:
-- 
2.2.0.rc0.207.ga3a616c


--- End Message ---
--- Begin Message ---
On 2014-12-16 06:22, Guillem Jover wrote:
> Package: release.debian.org
> Severity: normal
> User: release.debian.org@packages.debian.org
> Usertags: unblock
> Control: block -1 by 770627
> 
> Hi!
> 
> I'd like to upload dpkg 1.17.23 with the following changes. I've
> excluded and filtered translation changes. I'm including a patch series
> instead of a debdiff, because it should be clearer and easier to spot
> specific changes you might not want to approve?
> 
> [...]
> 

Hi,

Unblocked, thanks.  Though note NB: auctex has not been fixed in testing
yet, so dpkg might be stalled a bit.  Michael Gilbert (CC'ed) suggested
he might do the tpu upload required to fix auctex (having already done
the NMU for unstable). :)

> I've also not added the --force-configure-any default switch, because we
> don't really know what happened with apt and dbus there, and if apt from
> stable is affected or not. Given the recent dpkg, apt, and dbus changes
> I think I'd rather let this as is, and wait in case it shows up again,
> which should give us more information (due to the new apt not eating
> dpkg's output).
> 
> Here's the full tentative changelog (with the translation changes
> already in master):
> 
> [...]
> 
> Thanks,
> Guillem
> 

Ok, revisit the --force-configure-any thing if it is still relevant
after dpkg/1.17.23 migrates.



~Niels

--- End Message ---

Reply to: