summaryrefslogtreecommitdiffstats
path: root/lib
AgeCommit message (Collapse)AuthorFilesLines
2019-03-01Sanitize file name received from Content-Disposition headerAndrew Gregory1-1/+2
When installing a remote package with "pacman -U <url>", pacman renames the downloaded package file to match the name given in the Content-Disposition header. However, pacman does not sanitize this name, which may contain slashes, before calling rename(). A malicious server (or a network MitM if downloading over HTTP) can send a content-disposition header to make pacman place the file anywhere in the filesystem, potentially leading to arbitrary root code execution. Notably, this bypasses pacman's package signature checking. For example, a malicious package-hosting server (or a network man-in-the-middle, if downloading over HTTP) could serve the following header: Content-Disposition: filename=../../../../../../usr/share/libalpm/hooks/evil.hook and pacman would move the downloaded file to /usr/share/libalpm/hooks/evil.hook. This invocation of "pacman -U" would later fail, unable to find the downloaded package in the cache directory, but the hook file would remain in place. The commands in the malicious hook would then be run (as root) the next time any package is installed. Discovered-by: Adam Suhl <asuhl@mit.edu> Signed-off-by: Allan McRae <allan@archlinux.org> (cherry picked from commit d197d8ab82cf10650487518fb968067897a12775)
2018-12-23always allow explicit empty siglevel for sync dbsAndrew Gregory1-1/+1
An empty siglevel does not do any signature verification which is exactly what we want when compiled without gpg support. This is already allowed in other parts of the codebase and required for the test suite to pass when compiled without gpg support. Fixes: FS#60880 Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com> Signed-off-by: Allan McRae <allan@archlinux.org> (cherry picked from commit 61fe73804305a8bbb434cdc245944df5284f1964)
2018-12-12Pull updated translations from TransifexAllan McRae43-930/+931
Mostly churn in string headers, but a few new or updated translations. Signed-off-by: Allan McRae <allan@archlinux.org>
2018-11-19handle EINTR while polling scripts/hooksAndrew Gregory1-1/+9
If poll() is interrupted by a signal, alpm was closing the socket it uses for listening to script/hook output. This would drop script output at the least and kill the script at the worst. Fixes FS#60396 Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com> Signed-off-by: Allan McRae <allan@archlinux.org> (cherry picked from commit ac959bb9c6ce549047a954109ae825158855e386)
2018-11-19reset signal handlers before running scripts/hooksAndrew Gregory1-0/+20
Front-ends or libraries may set signals to be ignored, which gets inherited across fork and exec. This can cause scripts to malfunction if they expect the signal. To make matters worse, scripts written in bash can't reset signals that were ignored when bash was started. Fixes FS#56756 Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com> Signed-off-by: Allan McRae <allan@archlinux.org> (cherry picked from commit 9886566abb375043740167ce5066f1a186c71176)
2018-11-19alpm: Fix SIGINT handling re: aborting downloadOlivier Brunel1-0/+1
Upon receiving SIGINT a flag is set to abort the (curl) download. However, since it was never reset/initialized, if a front-end doesn't actually exit on SIGINT, and later tries any operation that needs to perform a new download, said download would always get aborted right away due to the flag not having been reset. (cherry picked from commit ffde85aadfe0e08fb710102d0a547335e9d1a200)
2018-11-19alpm: Do not raise SIGINT when filesize goes over limitOlivier Brunel1-1/+1
Variable dload_interrupted is used both to abort a download because SIGINT was caught, and when a file limit is reached. But raising SIGINT is only meant to happen in the first case. Signed-off-by: Olivier Brunel <jjk@jjacky.com> (cherry picked from commit d96d0ffe7c88d9521a9e6cdd65939e9a20733cdf)
2018-11-19libalpm/dload.c: add case for CURLE_COULDNT_RESOLVE_HOSTMichael Straube1-0/+7
Add a case for curl error 'Could not resolve host'. An attempt to fix FS#48285. Signed-off-by: Michael Straube <straubem@gmx.de> Signed-off-by: Allan McRae <allan@archlinux.org> (cherry picked from commit 9e960d9d5a735bbc7d418f2ad81d3f3e92d99968)
2018-07-27Pull updated translations from TransifexAllan McRae7-113/+120
Signed-off-by: Allan McRae <allan@archlinux.org>
2018-07-27Handle root prefix in overwrite operationsAllan McRae1-4/+5
The pacman --overwrite operation currently expects a path without the root prefix specified. This is unexpected, particularly given our conflict error message reports the path with the root prefix included. This patch allows libalpm to overwrite files with the root prefix specified. Signed-off-by: Allan McRae <allan@archlinux.org>
2018-06-18libalpm/dload.c: fix filename in license headerMichael Straube1-1/+1
The filename in the license header did not match the actual filename as in the other files. Hopefully this is not too nit-picky. Signed-off-by: Michael Straube <straubem@gmx.de> Signed-off-by: Allan McRae <allan@archlinux.org>
2018-05-28Pull updated translations from TransifexAllan McRae48-5356/+359
Also remove any translations that are less than 75% complete. These will be readded once translation completion passes our minimum threshold. Signed-off-by: Allan McRae <allan@archlinux.org>
2018-05-15Pull translations from Transifex and regenerateAllan McRae48-2324/+3412
Signed-off-by: Allan McRae <allan@archlinux.org>
2018-05-14Remove all modelines from the projectEli Schwartz53-104/+0
Many of these are pointless (e.g. there is no need to explicitly turn on spellchecking and language dictionaries for the manpages by default). The only useful modelines are the ones enforcing the project coding standards for indentation style (and "maybe" filetype/syntax, but everything except the asciidoc manpages and makepkg.conf is already autodetected), and indent style can be applied more easily with .editorconfig Signed-off-by: Eli Schwartz <eschwartz@archlinux.org> Signed-off-by: Allan McRae <allan@archlinux.org>
2018-05-12Fix gcc8 warnings.Eli Schwartz1-4/+12
Attempting to compile pacman with gcc8 results in several warnings like: remove.c: In function ‘unlink_file.isra.4’: remove.c:407:34: warning: ‘.pacsave.’ directive output may be truncated writing 9 bytes into a region of size between 1 and 4096 [-Wformat-truncation=] Fix by adding checks to error out if snprintf tries to reserve a truncated filename. Because the return values are checked, gcc delegates the truncation response to our code instead of throwing warnings. Signed-off-by: Eli Schwartz <eschwartz@archlinux.org> Signed-off-by: Allan McRae <allan@archlinux.org>
2018-04-29add missing newline to error messageAllan McRae1-1/+1
Signed-off-by: Allan McRae <allan@archlinux.org>
2018-04-29Initial translation preparation for pacman-5.1Allan McRae42-3790/+11262
Signed-off-by: Allan McRae <allan@archlinux.org>
2018-04-29Import updated translations from TransifexAllan McRae48-3895/+4401
Signed-off-by: Allan McRae <allan@archlinux.org>
2018-04-29Update POTFILES.inAllan McRae1-2/+5
Add all files to the relevant POTFILES.in. This avoids missing translations added to old files. Signed-off-by: Allan McRae <allan@archlinux.org>
2018-04-29libalpm.pc: migrate to Requires.privateEli Schwartz1-1/+2
pkg-config has built-in dependency handling, but we currently insert the raw $LIBS into libalpm's own linker flags and fail to handle Cflags at all. For dependencies which support pkg-config, simply use that instead. Signed-off-by: Eli Schwartz <eschwartz@archlinux.org> Signed-off-by: Allan McRae <allan@archlinux.org>
2018-03-14Update coyrights for 2018Allan McRae52-52/+52
make update-copyright OLD=2017 NEW=201 Signed-off-by: Allan McRae <allan@archlinux.org>
2018-03-14hooks: Complain if hook parameters are overwritten. Fixed 2 space leaks.Stefan Klinger1-0/+16
Signed-off-by: Stefan Klinger <git@stefan-klinger.de> Signed-off-by: Allan McRae <allan@archlinux.org>
2018-01-11Support new OpenPGP format packets lengthsAllan McRae1-71/+107
RFC 4880 defines two packet formats for OpenPGP. Pacman aborted its key in keyring check with an error message if it encountered the new format. This was fine until some annoying Arch Trusted User generated a key using the new format! Implement the new format. This also required parsing the hashed sub packets. requiring the parsing code to moved to its own function. Signed-off-by: Allan McRae <allan@archlinux.org>
2018-01-10add missing newline to debug messageAndrew Gregory1-1/+1
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com> Signed-off-by: Allan McRae <allan@archlinux.org>
2018-01-10detect pkghash allocation failureAndrew Gregory5-14/+28
If rehash ever failed with a full hash it would return the old hash that is already full. get_hash_position would then loop forever because it would never find an empty bucket. Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com> Signed-off-by: Allan McRae <allan@archlinux.org>
2018-01-10Do not continuously try to open an invalid databaseAllan McRae1-0/+2
If you manage to download a bad database (e.g. an html file when behind a proxy or with a badly configured webserver), pacman makes sure you know about it. Here is some example output: error: could not open file /var/lib/pacman/sync/extra.db: Unrecognized archive format error: could not open file /var/lib/pacman/sync/extra.db: Unrecognized archive format error: could not open file /var/lib/pacman/sync/extra.db: Unrecognized archive format error: could not open file /var/lib/pacman/sync/extra.db: Unrecognized archive format error: could not open file /var/lib/pacman/sync/extra.db: Unrecognized archive format error: could not open file /var/lib/pacman/sync/extra.db: Unrecognized archive format error: could not open file /var/lib/pacman/sync/extra.db: Unrecognized archive format error: could not open file /var/lib/pacman/sync/extra.db: Unrecognized archive format error: could not open file /var/lib/pacman/sync/extra.db: Unrecognized archive format error: could not open file /var/lib/pacman/sync/extra.db: Unrecognized archive format error: could not open file /var/lib/pacman/sync/extra.db: Unrecognized archive format error: could not open file /var/lib/pacman/sync/extra.db: Unrecognized archive format error: could not open file /var/lib/pacman/sync/extra.db: Unrecognized archive format error: could not open file /var/lib/pacman/sync/extra.db: Unrecognized archive format error: could not open file /var/lib/pacman/sync/extra.db: Unrecognized archive format error: could not open file /var/lib/pacman/sync/extra.db: Unrecognized archive format error: could not open file /var/lib/pacman/sync/extra.db: Unrecognized archive format error: could not open file /var/lib/pacman/sync/extra.db: Unrecognized archive format error: could not open file /var/lib/pacman/sync/extra.db: Unrecognized archive format error: could not open file /var/lib/pacman/sync/extra.db: Unrecognized archive format error: could not open file /var/lib/pacman/sync/extra.db: Unrecognized archive format error: could not open file /var/lib/pacman/sync/extra.db: Unrecognized archive format error: could not open file /var/lib/pacman/sync/extra.db: Unrecognized archive format error: could not open file /var/lib/pacman/sync/extra.db: Unrecognized archive format I don't know how many times that gets printed because it goes beyond my scrollback buffer. Flag a database that we can "open" and "fstat" but not read from as invalid to avoid this. Signed-off-by: Allan McRae <allan@archlinux.org>
2018-01-06do not rely on name hashes for matchingAndrew Gregory1-4/+2
6cfc4757b98e813428d261dbc185e20618ca83a6 was overzealous in attempting to optimize away a call to strcmp based on a comparison of hashes. The call can be skipped if the hashes are different, but different strings could have the same hash. Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com> Signed-off-by: Allan McRae <allan@archlinux.org>
2018-01-06dload: ensure callback is always initialized onceAndrew Gregory2-4/+6
Frontends rely on an initialization call for setup between downloads. Checking for intialization after checking for a completed download can skip initialization in cases where files are small enough to be downloaded all at once (FS#56408). Relying on previous download size can result in multiple initializations if there are multiple non-transfer events prior to the download starting (fS#56468). Introduce a new cb_initialized variable to the payload struct and use it to ensure that the callback is initialized exactly once prior to any actual events. Fixes FS#56408, FS#56468 Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com> Signed-off-by: Allan McRae <allan@archlinux.org>
2018-01-06avoid printing NULL stringAndrew Gregory1-1/+1
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com> Signed-off-by: Allan McRae <allan@archlinux.org>
2017-12-07Fix CVE-2016-5434 (DoS/loop and out of boundary read)Nils Freydank1-4/+44
This is a rewrite of Tobias Stoeckmann’s patch from June 2016[1] using functions instead of macros. (Thanks to Tobias for explanations of his patch.) A short question on Freenode IRC showed that macros are generally discouraged and functions should be used. The patch introduces a static size_t length_check() in libalpm/signing.c. [1] Original patch: https://lists.archlinux.org/pipermail/pacman-dev/2016-June/021148.html CVE request (and assignment): http://seclists.org/oss-sec/2016/q2/526 Signed-off-by: Allan McRae <allan@archlinux.org>
2017-07-28Fix brace coding style issuesMichael Straube2-4/+5
- Add missing braces to one-line if blocks - Move opening brace to line end Signed-off-by: Michael Straube <straubem@gmx.de>
2017-07-06alpm_list: abort on memory allocation failureAndrew Gregory1-5/+24
This makes it possible to detect a failure in several alpm_list functions. Previously these functions would continue after a failure, returning partial results and potentially leaking memory. Unfortunately, NULL is a valid return value for the affected functions if the input list is empty, so they still do not have a dedicated error value. Callers can at least detect an error by checking if the input list was empty. Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com> Signed-off-by: Allan McRae <allan@archlinux.org>
2017-07-06fix typo in libalpm commentChristian Hesse1-1/+1
contatenate -> concatenate Signed-off-by: Christian Hesse <mail@eworm.de> Signed-off-by: Allan McRae <allan@archlinux.org>
2017-05-16alpm_unlock: check handle before dereferencingAndrew Gregory1-0/+1
Prevents SIGSEGV if we catch SIGINT or SIGHUP before initializing alpm. Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com> Signed-off-by: Allan McRae <allan@archlinux.org>
2017-05-08free memory for --overwrite listsAndrew Gregory1-0/+1
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com> Signed-off-by: Allan McRae <allan@archlinux.org>
2017-05-08be_sync: error out if a db cannot be parsedAndrew Gregory1-5/+12
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com> Signed-off-by: Allan McRae <allan@archlinux.org>
2017-04-17run_chroot: label pipe endpoints for readabilityAndrew Gregory1-12/+17
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
2017-04-17use sockets for scriptlet/hook communicationAndrew Gregory1-13/+4
If a scriptlet/hook dies at the wrong moment it can trigger SIGPIPE, terminating the process. For pipes, there is no way to prevent SIGPIPE other than ignoring it process-wide. This can have unintended consequences in a multi-threaded process. Using send(2) with sockets, however, allows ignoring SIGPIPE on a per-call basis, leaving other threads able to make use of SIGPIPE. Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
2017-04-17conflict: include owner for filesystem conflictsAndrew Gregory1-5/+20
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
2017-04-17unlink_file: strip trailing slashesAndrew Gregory1-1/+12
If the user replaces a directory with a symlink, libalpm would get confused because the trailing slash causes system calls to resolve the symlink. This leads to errors and a misleading message during upgrades. Even though libalpm does not support this, it should not be giving misleading errors. Also adds an overflow check. Fixes FS#51377 Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
2017-04-16sortbydeps: rename vptr -> iAndrew Gregory1-5/+5
vptr is a simple list iterator, which are typically named i. Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
2017-04-16sortbydeps: rename found -> switched_to_childAndrew Gregory1-4/+4
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
2017-04-16sortbydeps: factor out dep cycle warningAndrew Gregory1-33/+37
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
2017-04-16graph.h: rename childptr -> iteratorAndrew Gregory3-10/+10
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
2017-04-16graph.h: replace hardcoded values with an enumAndrew Gregory3-8/+14
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
2017-04-12add --overwrite option to ignore file conflictsAndrew Gregory4-4/+37
Allows for safer, more fine-grained control for overwriting files than --force's all-or-nothing approach. Implements FS#31549. Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com> Signed-off-by: Allan McRae <allan@archlinux.org>
2017-04-12libalpm: Use archive_read_extract2Armin K1-1/+15
archive_read_extract() forces resolution of uid/gid to names when extracting the tarball. This can lead to wrong file ownership when using pacman with -r option and when uid/gid differ in the host and in the chroot. archive_read_extract2() uses uid's and gid's only. See also: https://lists.archlinux.org/pipermail/pacman-dev/2017-March/021912.html Signed-off-by: Armin K <krejzi@email.com> Signed-off-by: Allan McRae <allan@archlinux.org>
2017-04-04add alpm_list_append_strdupAndrew Gregory2-0/+21
Makes error detection and handling easier for a common operation. Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com> Signed-off-by: Allan McRae <allan@archlinux.org>
2017-04-04Ignore comments in INSTALL files (FS#51916)Michael Straube1-0/+4
If a comment in an INSTALL file contains the name of a valid INSTALL file function but the function itself is not present, pacman tries to execute that function. That leads to an error. Ignore comments in the grep function in libalpm/trans.c to avoid such errors. Signed-off-by: Michael Straube <straubem@gmx.de> Signed-off-by: Allan McRae <allan@archlinux.org>
2017-01-13Introduce a 'disable-download-timeout' optionChristian Hesse4-2/+17
Add command line option ('--disable-download-timeout') and config file option ('DisableDownloadTimeout') to disable defaults for low speed limit and timeout on downloads. Use this if you have issues downloading files with proxy and/or security gateway. Signed-off-by: Christian Hesse <mail@eworm.de> Signed-off-by: Allan McRae <allan@archlinux.org>
generated by cgit v1.2.3-24-g4f1b (git 2.32.0) at 2024-05-17 23:14:33 +0200