Fix buffer overflow in debListParser::VersionHash()

[apt.git] / apt-pkg / deb / deblistparser.cc

diff --git a/apt-pkg/deb/deblistparser.cc b/apt-pkg/deb/deblistparser.cc
index 17e781c486a95df21308729259351d244f2c7d71..e24ced27189fff38650ab555f29623c585e99c56 100644 (file)
--- a/apt-pkg/deb/deblistparser.cc
+++ b/apt-pkg/deb/deblistparser.cc
@@ -72,9 +72,9 @@ string debListParser::Package() {
 // ListParser::Architecture - Return the package arch                  /*{{{*/
 // ---------------------------------------------------------------------
 /* This will return the Architecture of the package this section describes */
-string debListParser::Architecture() {
+APT::StringView debListParser::Architecture() {
    auto const Arch = Section.Find("Architecture");
-   return Arch.empty() ? "none" : Arch.to_string();
+   return Arch.empty() ? "none" : Arch;
 }
                                                                        /*}}}*/
 // ListParser::ArchitectureAll                                         /*{{{*/
@@ -89,9 +89,9 @@ bool debListParser::ArchitectureAll() {
 /* This is to return the string describing the version in debian form,
    epoch:upstream-release. If this returns the blank string then the 
    entry is assumed to only describe package properties */
-string debListParser::Version()
+APT::StringView debListParser::Version()
 {
-   return Section.Find("Version").to_string();
+   return Section.Find("Version");
 }
                                                                        /*}}}*/
 unsigned char debListParser::ParseMultiArch(bool const showErrors)     /*{{{*/
@@ -144,7 +144,7 @@ bool debListParser::NewVersion(pkgCache::VerIterator &Ver)
       Ver->Section = idx;
    }
    // Parse the source package name
-   pkgCache::GrpIterator const G = Ver.ParentPkg().Group();
+   pkgCache::GrpIterator G = Ver.ParentPkg().Group();
    Ver->SourcePkgName = G->Name;
    Ver->SourceVerStr = Ver->VerStr;
    if (Section.Find("Source",Start,Stop) == true)
@@ -154,24 +154,25 @@ bool debListParser::NewVersion(pkgCache::VerIterator &Ver)
 
       if (Space != NULL)
       {
-        Stop = Space;
         const char * const Open = (const char * const) memchr(Space, '(', Stop - Space);
         if (likely(Open != NULL))
         {
            const char * const Close = (const char * const) memchr(Open, ')', Stop - Open);
            if (likely(Close != NULL))
            {
-              std::string const version(Open + 1, (Close - Open) - 1);
+              APT::StringView const version(Open + 1, (Close - Open) - 1);
               if (version != Ver.VerStr())
               {
                  map_stringitem_t const idx = StoreString(pkgCacheGenerator::VERSIONNUMBER, version);
+                 G = Ver.ParentPkg().Group();
                  Ver->SourceVerStr = idx;
               }
            }
         }
+        Stop = Space;
       }
 
-      std::string const pkgname(Start, Stop - Start);
+      APT::StringView const pkgname(Start, Stop - Start);
       if (pkgname != G.Name())
       {
         for (pkgCache::PkgIterator P = G.PackageList(); P.end() == false; P = G.NextPkg(P))
@@ -190,6 +191,7 @@ bool debListParser::NewVersion(pkgCache::VerIterator &Ver)
         if (V.end() == true)
         {
            map_stringitem_t const idx = StoreString(pkgCacheGenerator::PKGNAME, pkgname);
+           G = Ver.ParentPkg().Group();
            Ver->SourcePkgName = idx;
         }
       }
@@ -235,24 +237,6 @@ bool debListParser::NewVersion(pkgCache::VerIterator &Ver)
    return true;
 }
                                                                        /*}}}*/
-// ListParser::Description - Return the description string             /*{{{*/
-// ---------------------------------------------------------------------
-/* This is to return the string describing the package in debian
-   form. If this returns the blank string then the entry is assumed to
-   only describe package properties */
-string debListParser::Description(std::string const &lang)
-{
-   return Description(StringView(lang)).to_string();
-}
-
-StringView debListParser::Description(StringView lang)
-{
-   if (lang.empty())
-      return Section.Find("Description");
-   else
-      return Section.Find(string("Description-").append(lang.data(), lang.size()));
-}
-                                                                       /*}}}*/
 // ListParser::AvailableDescriptionLanguages                           /*{{{*/
 std::vector<std::string> debListParser::AvailableDescriptionLanguages()
 {
@@ -287,7 +271,7 @@ MD5SumValue debListParser::Description_md5()
    StringView const value = Section.Find("Description-md5");
    if (value.empty() == true)
    {
-      StringView const desc = Description(StringView());
+      StringView const desc = Section.Find("Description");
       if (desc == "\n")
         return MD5SumValue();
 
@@ -373,8 +357,12 @@ unsigned short debListParser::VersionHash()
            continue;
         *J++ = tolower_ascii(*Start);
 
-        if ((*Start == '<' || *Start == '>') && Start[1] != *Start && Start[1] != '=')
-           *J++ = '=';
+        /* Normalize <= to < and >= to >. This is the wrong way around, but
+         * more efficient that the right way. And since we're only hashing
+         * it does not matter which way we normalize. */
+        if ((*Start == '<' || *Start == '>') && Start[1] == '=') {
+           Start++;
+        }
       }
 
       Result = AddCRC16(Result,S,J - S);
@@ -669,7 +657,7 @@ const char *debListParser::ParseDepends(const char *Start,const char *Stop,
               ++I;
            }
 
-           std::string arch(I, End);
+           std::string const arch(I, End);
            if (arch.empty() == false && matchesArch(arch.c_str()) == true)
            {
               Found = true;
@@ -751,8 +739,7 @@ const char *debListParser::ParseDepends(const char *Start,const char *Stop,
                  ++I;
               }
 
-              std::string restriction(I, End);
-
+              std::string const restriction(I, End);
               if (restriction.empty() == false && profiles.empty() == false &&
                  std::find(profiles.begin(), profiles.end(), restriction) != profiles.end())
               {
@@ -813,7 +800,7 @@ bool debListParser::ParseDepends(pkgCache::VerIterator &Ver,
 {
    const char *Start;
    const char *Stop;
-   if (Section.Find(Tag,Start,Stop) == false)
+   if (Section.Find(Tag,Start,Stop) == false || Start == Stop)
       return true;
 
    string const pkgArch = Ver.Arch();
@@ -843,12 +830,13 @@ bool debListParser::ParseDepends(pkgCache::VerIterator &Ver,
       {
         // Such dependencies are not supposed to be accepted …
         // … but this is probably the best thing to do anyway
-        std::string Pkg;
         if (Package.substr(found + 1) == "native")
-           Pkg = Package.substr(0, found).to_string() + ':' + Ver.Cache()->NativeArch();
-        else
-           Pkg = Package.to_string();
-        if (NewDepends(Ver, Pkg, "any", Version, Op | pkgCache::Dep::ArchSpecific, Type) == false)
+        {
+           std::string const Pkg = Package.substr(0, found).to_string() + ':' + Ver.Cache()->NativeArch();
+           if (NewDepends(Ver, Pkg, "any", Version, Op | pkgCache::Dep::ArchSpecific, Type) == false)
+              return false;
+        }
+        else if (NewDepends(Ver, Package, "any", Version, Op | pkgCache::Dep::ArchSpecific, Type) == false)
            return false;
       }