Bug 919435 - RPM segfaults when installing a package with huge (80k) number of files.
Summary: RPM segfaults when installing a package with huge (80k) number of files.
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: rpm   
(Show other bugs)
Version: 6.5
Hardware: x86_64
OS: Linux
unspecified
high
Target Milestone: rc
: ---
Assignee: Packaging Maintenance Team
QA Contact: Karel Srot
URL:
Whiteboard:
Keywords:
Depends On: 706935
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-03-08 13:03 UTC by Panu Matilainen
Modified: 2013-11-21 21:39 UTC (History)
4 users (show)

Fixed In Version: rpm-4.8.0-35.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 706935
Environment:
Last Closed: 2013-11-21 21:39:50 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2013:1665 normal SHIPPED_LIVE rpm bug fix update 2013-11-20 21:53:00 UTC

Description Panu Matilainen 2013-03-08 13:03:04 UTC
+++ This bug was initially created as a clone of Bug #706935 +++

Description of problem:
RPM sigfaults when installing a package with huge (80k) number of files.

Version-Release number of selected component (if applicable):


How reproducible:
Try to install package with huge number of files. Can be done using clean local DB under non-root user.

Steps to Reproduce:
1. rpm --define "_dbpath /tmp" --initdb
2. wget http://atlas-computing.web.cern.ch/atlas-computing/links/reposDirectory/offline/slc5/noarch/AtlasSimulation_16_6_6_noarch-1-1.noarch.rpm 
(NB: 90Mb package)
3. rpm --define "_dbpath /tmp" -i --prefix=/tmp --nodeps AtlasSimulation_16_6_6_noarch-1-1.noarch.rpm
Segmentation fault (core dumped)

Actual results:

#0  headerCheck (ts=0x9e146c0, uh=0x0, uc=21704528, msg=0x7fff1aa33e68) at package.c:331
331	    int_32 il = ntohl(ei[0]);
(gdb) bt
#0  headerCheck (ts=0x9e146c0, uh=0x0, uc=21704528, msg=0x7fff1aa33e68) at package.c:331
#1  0x00000037a2634bec in rpmdbAdd (db=0x9e16080, iid=<value optimized out>, h=0xc6580c0, ts=0x9e146c0, hdrchk=0x37a2a20210 <headerCheck>)
    at rpmdb.c:3140
#2  0x00000037a2a2595a in rpmpsmStage (psm=0xc6579d0, stage=<value optimized out>) at psm.c:2111
#3  0x00000037a2a266c5 in rpmpsmStage (psm=0xc6579d0, stage=PSM_POST) at psm.c:1871
#4  0x00000037a2a25f8d in rpmpsmStage (psm=0xc6579d0, stage=PSM_PKGINSTALL) at psm.c:1994
#5  0x00000037a2a48845 in rpmtsRun (ts=0x9e146c0, okProbs=0x0, ignoreSet=<value optimized out>) at transaction.c:2185
#6  0x00000037a2a37aa3 in rpmInstall (ts=0x9e146c0, ia=0x37a2c6bf80, fileArgv=<value optimized out>) at rpminstall.c:701
#7  0x00000000004043a0 in main (argc=7, argv=<value optimized out>) at ./rpmqv.c:798


Expected results:
installed package.

Additional info:
"uh" pointer returned earlier by doHeaderUnload not checked but may be zero.
This is not native RHEL5, but the same code base.
The same behaviour seen on RHEL6.

--- Additional comment from Andrei on 2011-05-24 03:57:23 EDT ---

we realized that the package installs without --prefix option.

--- Additional comment from Panu Matilainen on 2011-05-24 06:21:41 EDT ---

Interesting case. There are actually several different (but related) issues here:
The original header is big, but below the artificially limited 16MB max header size. However relocation nearly doubles the size because rpm saves both the original and relocated paths in the header, and that pushes the total header size above the limit, causing headerUnload() to return NULL which then blows up in rpmdbAdd().

rpm >= 4.9.0 doesn't crash (it checks for the NULL) but adding the header fails there too, causing the install to be considered failed despite all the files having been laid on disk already. Failing this because of an artificial size limit is silly, especially since it's rpm itself which causes the limit to be exceeded here when the original header from the package is perfectly legal even with the current (arguably too low) limit on the header size.

--- Additional comment from Panu Matilainen on 2013-03-08 08:02:13 EST ---

Sorry, this has gone all but forgotten. We wont be able to address the fundamental limitation in rhel-5 (or -6 for that matter) but segfaulting is not acceptable, that needs to be fixed.

Comment 2 RHEL Product and Program Management 2013-07-25 21:10:14 UTC
This request was evaluated by Red Hat Product Management for
inclusion in a Red Hat Enterprise Linux release.  Product
Management has requested further review of this request by
Red Hat Engineering, for potential inclusion in a Red Hat
Enterprise Linux release for currently deployed products.
This request is not yet committed for inclusion in a release.

Comment 11 errata-xmlrpc 2013-11-21 21:39:50 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-1665.html


Note You need to log in before you can comment on or make changes to this bug.