Currently we make no effort to validate the %FILENAME% field in the repo db. This allows for relative paths to be considered valid. A carefully crafted db entry with a malicious relative path, (e.g. `../../../../etc/passwd`) will cause pacman to to overwrite _any_ file on the target's machine. Signed-off-by: Simon Gomizelj --- lib/libalpm/be_sync.c | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/lib/libalpm/be_sync.c b/lib/libalpm/be_sync.c index 1cbe055..2cd756d 100644 --- a/lib/libalpm/be_sync.c +++ b/lib/libalpm/be_sync.c @@ -479,6 +479,34 @@ cleanup: return count; } +/* This function validates %FILENAME%. filename must be between 3 and + * PATH_MAX characters and cannot be contain a path */ +static int _alpm_validate_filename(alpm_db_t *db, const char *pkgname, + const char *filename) +{ + size_t len = strlen(filename); + size_t cache_len = strlen(db->handle->dbpath) + strlen(db->handle->root); + + if(len < 3) { + errno = EINVAL; + _alpm_log(db->handle, ALPM_LOG_ERROR, _("%s database is inconsistent: filename " + "of package %s is too short\n"), db->treename, pkgname); + return -1; + } else if(len - cache_len > PATH_MAX) { + errno = EINVAL; + _alpm_log(db->handle, ALPM_LOG_ERROR, _("%s database is inconsistent: filename " + "of package %s is too long\n"), db->treename, pkgname); + return -1; + } else if(memchr(filename, '/', len) != NULL) { + errno = EINVAL; + _alpm_log(db->handle, ALPM_LOG_ERROR, _("%s database is inconsistent: filename " + "of package %s is illegal\n"), db->treename, pkgname); + return -1; + } + + return 0; +} + #define READ_NEXT() do { \ if(_alpm_archive_fgets(archive, &buf) != ARCHIVE_OK) goto error; \ line = buf.line; \ @@ -558,6 +586,9 @@ static int sync_db_read(alpm_db_t *db, struct archive *archive, } } else if(strcmp(line, "%FILENAME%") == 0) { READ_AND_STORE(pkg->filename); + if(_alpm_validate_filename(db, pkg->name, pkg->filename) < 0) { + return -1; + } } else if(strcmp(line, "%DESC%") == 0) { READ_AND_STORE(pkg->desc); } else if(strcmp(line, "%GROUPS%") == 0) { -- 1.8.2.2

Prevent scriptlets from clobbering pacman.log because they don't end their outputs with a newline. --- lib/libalpm/util.c | 42 ++++++++++++++++++++++++------------------ 1 file changed, 24 insertions(+), 18 deletions(-) diff --git a/lib/libalpm/util.c b/lib/libalpm/util.c index 033058a..c1fd0bb 100644 --- a/lib/libalpm/util.c +++ b/lib/libalpm/util.c @@ -555,23 +555,34 @@ int _alpm_run_chroot(alpm_handle_t *handle, const char *cmd, char *const argv[]) exit(1); } else { /* this code runs for the parent only (wait on the child) */ - int status; - FILE *pipe_file; + int status, need_newline = 0; CLOSE(pipefd[1]); - pipe_file = fdopen(pipefd[0], "r"); - if(pipe_file == NULL) { - CLOSE(pipefd[0]); - retval = 1; - } else { - while(!feof(pipe_file)) { - char line[PATH_MAX]; - if(fgets(line, PATH_MAX, pipe_file) == NULL) + for(;;) { + char line[BUFSIZ]; + int nbytes_r = read(pipefd[0], line, BUFSIZ); + + if(nbytes_r == 0) { + break; + } else if(nbytes_r == -1) { + if (errno != EINTR) { + _alpm_log(handle, ALPM_LOG_ERROR, _("failed to read from pipe (%s)\n"), strerror(errno)); + retval = 1; break; - alpm_logaction(handle, "%s", line); - EVENT(handle, ALPM_EVENT_SCRIPTLET_INFO, line, NULL); + } + continue; } - fclose(pipe_file); + + /* we'll need to manually add a newline if the read data doesn't end with one already */ + need_newline = (line[nbytes_r - 1] != '\n'); + + alpm_logaction(handle, "%s", line); + EVENT(handle, ALPM_EVENT_SCRIPTLET_INFO, line, NULL); + } + CLOSE(pipefd[0]); + + if (need_newline) { + alpm_logaction(handle, "\n"); } while(waitpid(pid, &status, 0) == -1) { @@ -582,11 +593,6 @@ int _alpm_run_chroot(alpm_handle_t *handle, const char *cmd, char *const argv[]) } } - /* report error from above after the child has exited */ - if(retval != 0) { - _alpm_log(handle, ALPM_LOG_ERROR, _("could not open pipe (%s)\n"), strerror(errno)); - goto cleanup; - } /* check the return status, make sure it is 0 (success) */ if(WIFEXITED(status)) { _alpm_log(handle, ALPM_LOG_DEBUG, "call to waitpid succeeded\n"); -- 1.8.0.2