[arch-commits] Commit in pacman/trunk (1 file)
Evangelos Foutras
foutrelis at archlinux.org
Wed Feb 17 07:00:31 UTC 2016
Date: Wednesday, February 17, 2016 @ 08:00:31
Author: foutrelis
Revision: 259883
Remove old patch
Deleted:
pacman/trunk/ensure-matching-database-and-package-version.patch
----------------------------------------------------+
ensure-matching-database-and-package-version.patch | 60 -------------------
1 file changed, 60 deletions(-)
Deleted: ensure-matching-database-and-package-version.patch
===================================================================
--- ensure-matching-database-and-package-version.patch 2016-02-17 05:29:13 UTC (rev 259882)
+++ ensure-matching-database-and-package-version.patch 2016-02-17 07:00:31 UTC (rev 259883)
@@ -1,60 +0,0 @@
-From deac9731884a83ad91eab9f27b288f406f56c87b Mon Sep 17 00:00:00 2001
-From: Levente Polyak <anthraxx at archlinux.org>
-Date: Sat, 18 Jul 2015 17:58:23 +0200
-Subject: [PATCH] ensure matching database and package version
-
-While loading each package ensure that the internal version matches the
-expected database version to avoid the possibility to circumvent the
-version check.
-This issue can be used by an attacker to trick the software into
-installing an older version. The behavior can be exploited by a
-man-in-the-middle attack through specially crafted database tarball
-containing a higher version, yet actually delivering an older and
-vulnerable version, which was previously shipped.
-
-Signed-off-by: Levente Polyak <anthraxx at archlinux.org>
-Signed-off-by: Remi Gacogne <rgacogne at archlinux.org>
-Signed-off-by: Allan McRae <allan at archlinux.org>
----
- lib/libalpm/sync.c | 18 ++++++++++++++++++
- 1 file changed, 18 insertions(+)
-
-diff --git a/lib/libalpm/sync.c b/lib/libalpm/sync.c
-index 888ae15..e843b07 100644
---- a/lib/libalpm/sync.c
-+++ b/lib/libalpm/sync.c
-@@ -1212,6 +1212,7 @@ static int load_packages(alpm_handle_t *handle, alpm_list_t **data,
- EVENT(handle, &event);
-
- for(i = handle->trans->add; i; i = i->next, current++) {
-+ int error = 0;
- alpm_pkg_t *spkg = i->data;
- char *filepath;
- int percent = (int)(((double)current_bytes / total_bytes) * 100);
-@@ -1232,6 +1233,23 @@ static int load_packages(alpm_handle_t *handle, alpm_list_t **data,
- spkg->name);
- alpm_pkg_t *pkgfile =_alpm_pkg_load_internal(handle, filepath, 1);
- if(!pkgfile) {
-+ _alpm_log(handle, ALPM_LOG_DEBUG, "failed to load pkgfile internal\n");
-+ error = 1;
-+ } else {
-+ if(strcmp(spkg->name, pkgfile->name) != 0) {
-+ _alpm_log(handle, ALPM_LOG_DEBUG,
-+ "internal package name mismatch, expected: '%s', actual: '%s'\n",
-+ spkg->name, pkgfile->name);
-+ error = 1;
-+ }
-+ if(strcmp(spkg->version, pkgfile->version) != 0) {
-+ _alpm_log(handle, ALPM_LOG_DEBUG,
-+ "internal package version mismatch, expected: '%s', actual: '%s'\n",
-+ spkg->version, pkgfile->version);
-+ error = 1;
-+ }
-+ }
-+ if(error != 0) {
- errors++;
- *data = alpm_list_add(*data, strdup(spkg->filename));
- free(filepath);
---
-2.4.6
-
More information about the arch-commits
mailing list