folkslinux
/
rpm
mirror of https://github.com/rpm-software-management/rpm.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
rpm/lib
History
Panu Matilainen a79d7ae0f0 Fix IMA signature lengths assumed constant (#1833, RhBug:2018937) 
At least ECDSA and RSA signatures can vary in length, but the IMA code
assumes constant lengths and thus may either place invalid signatures on
disk from either truncating or overshooting, and segfault if the stars are
just so.

Luckily the signatures are stored as strings so we can calculate the
actual lengths at runtime and ignore the stored constant length info.
Extend hex2bin() to optionally calculate the lengths and maximum,
and use these for returning IMA data from the rpmfi(les) API.

Additionally update the signing code to store the largest IMA signature
length rather than what happened to be last to be on the safe side.
We can't rely on this value due to invalid packages being out there,
but then we need to calculate the lengths on rpmfiles populate so there's
not a lot to gain anyhow.

Fixes: #1833
 		2021-12-13 10:38:36 +02:00
..
backend Include rpmpgp.h only where it is actually needed 2021-11-17 14:21:06 +02:00
Makefile.am Fix build regression from 376fef14a6 2021-04-26 11:35:30 +03:00
cpio.c Shut up bogus Doxygen warnings about undocumented parameters 2020-10-28 10:40:41 +02:00
cpio.h Shut up bogus Doxygen warnings about undocumented parameters 2020-10-28 10:40:41 +02:00
depends.c Include rpmpgp.h only where it is actually needed 2021-11-17 14:21:06 +02:00
formats.c Use the new shescape macro for :shescape query format too 2021-09-24 14:55:44 +02:00
fprint.c Include rpmpgp.h only where it is actually needed 2021-11-17 14:21:06 +02:00
fprint.h Shut up bogus Doxygen warnings about undocumented parameters 2020-10-28 10:40:41 +02:00
fsm.c Fix 32bit compiler warning in recently added fsm debugging 2021-04-08 12:24:10 +03:00
fsm.h Shut up bogus Doxygen warnings about undocumented parameters 2020-10-28 10:40:41 +02:00
gentagtbl.sh Use actual enum values in tag table sentinel to avoid int/enum mismatch 2010-09-21 15:26:25 +03:00
header.c Make a bounds check easier to read 2021-06-21 14:42:13 +03:00
header.h Issue build-time deprecation warnings for unsafe header interfaces 2021-03-11 10:58:48 +02:00
header_internal.h Make retrofit etc helpers static again now that we can 2018-04-25 16:27:45 +03:00
headerfmt.c Include rpmpgp.h only where it is actually needed 2021-11-17 14:21:06 +02:00
headerutil.c Fix a tiny memory leak 2021-03-04 16:22:54 +02:00
manifest.c Include rpmpgp.h only where it is actually needed 2021-11-17 14:21:06 +02:00
manifest.h Shut up bogus Doxygen warnings about undocumented parameters 2020-10-28 10:40:41 +02:00
misc.h Clean up rpmdb leftovers from an atexit() handler. 2016-12-13 11:19:03 +02:00
order.c Shut up bogus Doxygen warnings about undocumented parameters 2020-10-28 10:40:41 +02:00
package.c Exclude the xlateTags symbol from librpm's public API. 2021-06-30 10:58:59 +02:00
poptALL.c Better detection of I/O errors (#1566) 2021-03-15 18:51:05 +01:00
poptI.c Include rpmpgp.h only where it is actually needed 2021-11-17 14:21:06 +02:00
poptQV.c Include rpmpgp.h only where it is actually needed 2021-11-17 14:21:06 +02:00
psm.c Allow an optional "override clock" for deterministic timestamps 2021-11-23 10:53:04 +02:00
query.c Include rpmpgp.h only where it is actually needed 2021-11-17 14:21:06 +02:00
relocation.c Include rpmpgp.h only where it is actually needed 2021-11-17 14:21:06 +02:00
rpmal.c Include rpmpgp.h only where it is actually needed 2021-11-17 14:21:06 +02:00
rpmal.h Use the transaction set as argument in rpmalCreate() 2020-02-24 11:54:22 +02:00
rpmarchive.h Make file open and close in fsm debuggable 2021-02-19 11:09:56 +02:00
rpmcallback.h Add package verification step to transactions 2018-05-09 14:16:07 +03:00
rpmchecksig.c Resurrect --prtpkts debug switch functionality 2019-10-31 11:59:20 +01:00
rpmchroot.c Only do early name services initialization if we actually chroot 2020-11-09 14:00:56 +02:00
rpmchroot.h Add "c++ protection" to (hopefully) all of our internal headers 2010-09-21 15:21:12 +03:00
rpmcli.h Add support for RPMDBI_BASENAMES on file queries 2021-09-13 16:24:20 +03:00
rpmdb.c Include rpmpgp.h only where it is actually needed 2021-11-17 14:21:06 +02:00
rpmdb.h Shut up bogus Doxygen warnings about undocumented parameters 2020-10-28 10:40:41 +02:00
rpmdb_internal.h Shut up bogus Doxygen warnings about undocumented parameters 2020-10-28 10:40:41 +02:00
rpmds.c Don't strip flags for OrderWithRequires in rpmds 2021-06-18 12:24:37 +03:00
rpmds.h Shut up bogus Doxygen warnings about undocumented parameters 2020-10-28 10:40:41 +02:00
rpmds_internal.h Axe --nopromote and most of the related infrastructure 2020-05-27 14:14:00 +02:00
rpmfi.c Fix IMA signature lengths assumed constant (#1833, RhBug:2018937) 2021-12-13 10:38:36 +02:00
rpmfi.h Shut up bogus Doxygen warnings about undocumented parameters 2020-10-28 10:40:41 +02:00
rpmfi_internal.h Add mode for updating with minimal writing (RhBug:783480) 2017-04-21 13:50:50 +03:00
rpmfiles.h Include rpmpgp.h only where it is actually needed 2021-11-17 14:21:06 +02:00
rpmfs.c Include rpmpgp.h only where it is actually needed 2021-11-17 14:21:06 +02:00
rpmfs.h Reset file actions between rpmtsRun() calls (RhBug:1076552) 2014-03-21 12:44:03 +02:00
rpmgi.c Include rpmpgp.h only where it is actually needed 2021-11-17 14:21:06 +02:00
rpmgi.h Stop abusing enum typedefs for bitfield types 2010-09-21 11:10:14 +03:00
rpmhash.C Fix memory leak in rpmhash implementation 2014-09-16 11:12:10 +02:00
rpmhash.H Add alternative hash key add/get/check methods with prehashed key 2012-09-05 10:38:36 +03:00
rpminstall.c Include rpmpgp.h only where it is actually needed 2021-11-17 14:21:06 +02:00
rpmlead.c Plug the last data "leak" from rpmlead 2018-04-18 14:36:01 +03:00
rpmlead.h Shut up bogus Doxygen warnings about undocumented parameters 2020-10-28 10:40:41 +02:00
rpmlib.h Include rpmpgp.h only where it is actually needed 2021-11-17 14:21:06 +02:00
rpmlock.c Include rpmpgp.h only where it is actually needed 2021-11-17 14:21:06 +02:00
rpmlock.h Export rpmlock release method internally as well 2013-03-11 11:12:35 +02:00
rpmplugin.h Drop the experimental collection support 2014-06-17 16:27:24 +03:00
rpmplugins.c Move <dlfcn.h> out of system.h 2020-02-04 16:39:16 +02:00
rpmplugins.h Fix doxygen warnings 2015-02-17 15:31:22 +01:00
rpmpol.h Stop abusing enum typedefs for bitfield types 2010-09-21 11:10:14 +03:00
rpmprob.c Add a pre-flight check for removed packages too 2020-06-02 15:25:57 +02:00
rpmprob.h Add package verification step to transactions 2018-05-09 14:16:07 +03:00
rpmps.c Fix couple of incorrect sizeof() uses 2011-03-17 14:08:54 +02:00
rpmps.h Eliminate all fooUnlink() functions out of the API 2010-09-13 13:08:33 +03:00
rpmrc.c Make Lua a hard requirement for rpm 2021-02-09 13:57:27 +02:00
rpmscript.c Restore scriptlet arguments passed as numbers to Lua scriptlets 2021-11-22 13:01:13 +02:00
rpmscript.h Make scriptlet error behavior a property of rpmScript "objects" 2018-03-09 12:21:37 +02:00
rpmtag.h Fix RPM_MIN_TYPE definition, RPM_NULL_TYPE is not a legit tag type 2021-04-16 15:57:00 +03:00
rpmtd.c Include rpmpgp.h only where it is actually needed 2021-11-17 14:21:06 +02:00
rpmtd.h Add query formats for displaying tag numbers and names 2021-03-15 13:47:26 +02:00
rpmte.c Include rpmpgp.h only where it is actually needed 2021-11-17 14:21:06 +02:00
rpmte.h Add support for application private user data in transaction elements 2020-09-28 11:17:24 +03:00
rpmte_internal.h Use an erase element to delete packages with same NEVRA 2019-07-22 16:42:15 +02:00
rpmtriggers.c Fix spurious %transfiletriggerpostun execution (RhBug:2023311) 2021-11-22 13:05:39 +02:00
rpmtriggers.h Fixups to file trigger internal api docs + comments 2017-12-13 12:06:45 +02:00
rpmts.c Allow an optional "override clock" for deterministic timestamps 2021-11-23 10:53:04 +02:00
rpmts.h Include rpmpgp.h only where it is actually needed 2021-11-17 14:21:06 +02:00
rpmts_internal.h Allow an optional "override clock" for deterministic timestamps 2021-11-23 10:53:04 +02:00
rpmtypes.h Add (beginnings of) a rpm version API (parsing, comparison) 2020-05-27 14:14:00 +02:00
rpmug.c Eliminate use of obsolete gethostbyname() function 2020-11-23 13:00:59 +02:00
rpmug.h Initialize all the name services we need 2014-01-28 09:45:55 +02:00
rpmvs.c verifySignature(): package signatures must be PGPSIGTYPE_BINARY 2021-11-01 10:59:03 +02:00
rpmvs.h Implement verify support for alternative digests and signatures 2019-10-28 15:27:56 +02:00
signature.c Don't require signature header to be in single contiguous region part II 2020-01-10 10:31:47 +02:00
signature.h Shut up bogus Doxygen warnings about undocumented parameters 2020-10-28 10:40:41 +02:00
tagexts.c Shut up bogus Doxygen warnings about undocumented parameters 2020-10-28 10:40:41 +02:00
tagname.c Remove compare of global array tagsByName to NULL 2020-07-21 09:25:34 +02:00
transaction.c Allow an optional "override clock" for deterministic timestamps 2021-11-23 10:53:04 +02:00
verify.c Include rpmpgp.h only where it is actually needed 2021-11-17 14:21:06 +02:00