Bug 2225180

Summary: aide fails to check some compressed databases
Product: Red Hat Enterprise Linux 8 Reporter: Rodney Barnett <rhbugzilla>
Component: aideAssignee: Radovan Sroka <rsroka>
Status: CLOSED MIGRATED QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 8.6CC: dapospis
Target Milestone: rcKeywords: MigratedToJIRA, Triaged
Target Release: ---   
Hardware: Unspecified   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-08-16 15:18:13 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Example configuration and database with the bug none

Description Rodney Barnett 2023-07-24 13:34:17 UTC
Description of problem:
The "aide -C" command fails to process a gzipped database file when the uncompressed file is exactly n*8192+11 bytes long for some n>0.

Version-Release number of selected component (if applicable):
aide-0.16-14.el8_5.1

How reproducible:
When the database size is as described, "aide -C" fails every time.

Steps to Reproduce:
It is difficult to create a database of the required size, but I have attached a contrived example.

Actual results:
The "aide -C" command fails with varying errors though usually the errors include "Trying to continue on line xx" for some xx and "db_char2line():Error while reading database"

Expected results:
The "aide -C" command should properly check the database.

Additional info:
This patch fixes the problem:
diff -ru aide-0.16/src/commandconf.c aide-0.16.modified/src/commandconf.c
--- aide-0.16/src/commandconf.c	2016-07-25 15:56:55.000000000 -0500
+++ aide-0.16.modified/src/commandconf.c	2023-07-18 08:48:11.913932324 -0500
@@ -303,6 +303,7 @@
       retval=0;
       buf[0]='\0';
     }else {
+      buf[0]='\0';
       if((retval=gzread(*db_gzp,buf,max_size))<0){
 	error(0,_("gzread() failed: gzerr=%s!\n"),gzerror(*db_gzp,&err));
 	retval=0;

Comment 1 Rodney Barnett 2023-07-24 13:39:25 UTC
Created attachment 1977301 [details]
Example configuration and database with the bug

Comment 2 Radovan Sroka 2023-08-16 15:12:42 UTC
This bug is going to be migrated.

Contact point for migration questions or issues: rsroka
Guidance for Bugzilla users to test their Jira account or create one if needed:

https://redhat.service-now.com/help?id=kb_article_view&sysparm_article=KB0016394
https://redhat.service-now.com/help?id=kb_article_view&sysparm_article=KB0016694
https://redhat.service-now.com/help?id=kb_article_view&sysparm_article=KB0016774