Bug 428225

Summary:	rpmlib segfaults on header read failure
Product:	Red Hat Enterprise Linux 4	Reporter:	Jon Stanley <jonstanley>
Component:	rpm	Assignee:	Panu Matilainen <pmatilai>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	4.5
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-06-20 13:19:00 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jon Stanley 2008-01-10 00:59:16 UTC

I was attempting to use createrepo and have a possibly corrupt rpm in the tree
(this tree has been known to have various corruption problems on my end). 
createrepo segfaults in rpmlib, in dataLength.

backtrace:

#0  0x00000030c8128c00 in dataLength (type=8, p=0x2a9a18ce4d, count=3429,
onDisk=1, pend=0x2a9a18ed83) at header.c:428
#1  0x00000030c8128d70 in regionSwab (entry=0x696130, il=1, dl=796089,
pe=0x2a9a0cc378, dataStart=0x2a9a0cc388 "C", 
    dataEnd=0x2a9a18ed83 "", regionid=-880) at header.c:523
#2  0x00000030c81298a6 in headerLoad (uh=Variable "uh" is not available.
) at header.c:1120
#3  0x00000030c851fc0b in rpmReadHeader (ts=0x68b880, fd=0x696b60,
hdrp=0x7fbffee458, msg=0x7fbffee468)
    at ../rpmdb/hdrinline.h:178
#4  0x00000030c851ffa4 in rpmReadPackageFile (ts=0x68b880, fd=0x696b60,
fn=0x2a9858d890 "rpmts_HdrFromFdno", 
    hdrp=0x7fbfffe4b8) at package.c:857
#5  0x0000002a98589dbf in rpmts_HdrFromFdno (s=0x2a99aed770, args=Variable
"args" is not available.
) at rpmts-py.c:768
#6  0x00000030c798961f in eval_frame (f=0x5acbe0) at Python/ceval.c:3439
#7  0x00000030c798a7be in eval_frame (f=0x6952d0) at Python/ceval.c:3518
#8  0x00000030c798b18e in PyEval_EvalCodeEx (co=0x2a99393f80, globals=Variable
"globals" is not available.
) at Python/ceval.c:2663
#9  0x00000030c7947d9d in function_call (func=0x2a99ad0b90, arg=0x2a997c99b0,
kw=0x0) at Objects/funcobject.c:504
#10 0x00000030c7935390 in PyObject_Call (func=Variable "func" is not available.
) at Objects/abstract.c:1755
#11 0x00000030c793c9bb in instancemethod_call (func=0x2a99ad0b90,
arg=0x2a997c99b0, kw=0x0) at Objects/classobject.c:2433
#12 0x00000030c7935390 in PyObject_Call (func=Variable "func" is not available.
) at Objects/abstract.c:1755
#13 0x00000030c7984a79 in PyEval_CallObjectWithKeywords (func=0x2a9939bcd0,
arg=0x2a99a2b7e0, kw=0x0)
    at Python/ceval.c:3346
#14 0x00000030c79388e5 in PyInstance_New (klass=Variable "klass" is not available.
) at Objects/classobject.c:575
#15 0x00000030c7935390 in PyObject_Call (func=Variable "func" is not available.
) at Objects/abstract.c:1755
#16 0x00000030c7988b88 in eval_frame (f=0x5f3180) at Python/ceval.c:3644
#17 0x00000030c798b18e in PyEval_EvalCodeEx (co=0x2a955ddf10, globals=Variable
"globals" is not available.
) at Python/ceval.c:2663
#18 0x00000030c798996a in eval_frame (f=0x539860) at Python/ceval.c:3528
#19 0x00000030c798a7be in eval_frame (f=0x69c2a0) at Python/ceval.c:3518
#20 0x00000030c798a7be in eval_frame (f=0x525d80) at Python/ceval.c:3518
#21 0x00000030c798b18e in PyEval_EvalCodeEx (co=0x2a9854c490, globals=Variable
"globals" is not available.
) at Python/ceval.c:2663
#22 0x00000030c798b3f2 in PyEval_EvalCode (co=Variable "co" is not available.
) at Python/ceval.c:537
#23 0x00000030c79a4019 in run_node (n=0x2a955ce050, filename=Variable "filename"
is not available.
) at Python/pythonrun.c:1267
#24 0x00000030c79a4ffd in PyRun_SimpleFileExFlags (fp=0x501010, 
    filename=0x7fbffffbcd "/usr/share/createrepo/genpkgmetadata.py", closeit=1,
flags=0x7fbffff8c4)
    at Python/pythonrun.c:862
#25 0x00000030c79aa6f8 in Py_Main (argc=2, argv=0x7fbffff9c8) at Modules/main.c:415
#26 0x00000030c721c3fb in __libc_start_main () from /lib64/tls/libc.so.6
#27 0x00000000004006ba in ?? ()
#28 0x0000007fbffff9b8 in ?? ()
#29 0x000000000000001c in ?? ()
#30 0x0000000000000004 in ?? ()
#31 0x0000007fbffffbba in ?? ()
#32 0x0000007fbffffbca in ?? ()
#33 0x0000007fbffffbcd in ?? ()
#34 0x0000007fbffffbf5 in ?? ()
#35 0x0000000000000000 in ?? ()

Comment 1 Jon Stanley 2008-01-10 01:06:16 UTC

I can provide the full core and/or the corrupt rpm if needed.  Also, a simple
'rpm -qip' on this package also segfaults in the same place.  Fedora versions of
rpm do not do this, but rather throw an error (which would be the expected
behavior).

[jstanley@dhcp-126 ~]$ rpm -qip kernel-PAE-debug-devel-2.6.23.8-63.fc8.i686.rpm
error: kernel-PAE-debug-devel-2.6.23.8-63.fc8.i686.rpm: headerRead failed:
Header sanity check: OK

The bad version of rpm is rpm-4.3.3-22_nonptl and the "good" version is
rpm-4.4.2.2-7.fc8

Comment 2 Jiri Pallich 2012-06-20 13:19:00 UTC

Thank you for submitting this issue for consideration in Red Hat Enterprise Linux. The release for which you requested us to review is now End of Life. 
Please See https://access.redhat.com/support/policy/updates/errata/

If you would like Red Hat to re-consider your feature request for an active release, please re-open the request via appropriate support channels and provide additional supporting details about the importance of this issue.