Bug 107835

**** I created this yesterday as bug#107784. Bugzilla wouldn't accept an
attachment upload from my old Netscape browser, then bugzilla went "down for
maintenance; try again later" before I could upload it Mozilla. Now it is
telling me I do not have permission to view bug#107784 (even after logging in).
???????? What is up with Bugzilla ?????????
So I am refiling it as a new bug report.
*****************************************************************************

Description of problem:
After experiencing various seemingly random segmentation faults in rpm (example:
on our system, "rpm -q -f /etc/profile" when run as root causes a segfault,
whereas it doesn't when run as an ordinary user) and other crashes and freezes,
and with the problems persisting even after updating to the latest rpm-4.2-1
from the rpm ftp site as suggested in other bug reports, I eventually tracked
the problem down with the help of "electric fence" to a dangling pointer in
rpmdb/rpmdb.c.

In the function rpmdbNextIterator, in the block of code beginning at line 2279,
the local pointer variable "set" stores a copy of mi->mi_db->db_bits. A few
lines further down, "set" is dereferenced to mark the header as checked.
However, in between, the call to mi->mi_hdrchk may recursively call
rpmdbNextIterator when searching for imported gpg keys to validate the
signature. In the process, the memory pointed to by "set" may be
reallocated, and "set" becomes a dangling pointer.

I have attached a patch which fixes this problem. It also fixes another more
minor problem that will also cause a segfault if rpm is run under Electric Fence
but would unlikely cause any problems otherwise.

Version-Release number of selected component (if applicable):
rpm-4.2-1

How reproducible:
Always

Steps to Reproduce:
1. Install Electric Fence and make sure a lot of RPM packages are installed.
2. Run "ef rpm -q /etc/profile".


Actual Results:  % ef rpm -q -f /etc/profile

  Electric Fence 2.2.0 Copyright (C) 1987-1999 Bruce Perens <bruce>
  Electric Fence 2.2.0 Copyright (C) 1987-1999 Bruce Perens <bruce>
/usr/bin/ef: line 20:  8513 Segmentation fault      ( export
LD_PRELOAD=libefence.so.0.0; exec $* )

This always segfaults on our system. Without the "ef", it segfaults
occasionally.

(If the above procedure doesn't reproduce the problem on a different system, it
may be necessary to substitute a different file for /etc/profile to see the
segfault, and or set the environment variable EF_PROTECT_FREE=1.)

Expected Results:  When the attached patch is applied:

% ef rpm -q -f /etc/profile

  Electric Fence 2.2.0 Copyright (C) 1987-1999 Bruce Perens <bruce>
  Electric Fence 2.2.0 Copyright (C) 1987-1999 Bruce Perens <bruce>
setup-2.5.25-1