Fix crash in VersionExtra using --with-source etc

VersionExtra holds, at runtime, the SHA256 of the packages being
added to try to avoid deduplicating obviously different packages;
the SHA256 itself is too large to store in the cache.

When volatile sources are used, the VersionExtra array is not
initialized, or rather it used to be initialized to 32*1024
zero elements as a performance optimization.

This meant that specifying --with-source with a package that
looks like a duplicate of a version with an ID >= 32*1024 triggered
the assertion; so we could not reproduce it easily in the test
suite.

Remove the optimized initialization to make the behavior more
uniform; and treat too large version IDs as having no SHA256.

Closes: #1098702

1 files changed, 10 insertions, 0 deletions

diff --git a/test/integration/test-same-version-but-different b/test/integration/test-same-version-but-different
index 595a66fb6..e57150cd6 100755
--- a/test/integration/test-same-version-but-different
+++ b/test/integration/test-same-version-but-different
@@ -107,3 +107,13 @@ testsuccessequal "diff-sha256:
         500 file:${APTARCHIVE} testing/main all Packages
      1 500
         500 file:${APTARCHIVE} unstable/main all Packages" apt policy diff-sha256
+testsuccessequal "diff-sha256:
+  Installed: (none)
+  Candidate: 1
+  Version table:
+     1 500
+        500 file:${APTARCHIVE} testing/main all Packages
+        500 ${APTARCHIVE}/dists/unstable/main/binary-all/Packages
+        500 ${APTARCHIVE}/dists/testing/main/binary-all/Packages
+     1 500
+        500 file:${APTARCHIVE} unstable/main all Packages" apt policy diff-sha256 --with-source ${APTARCHIVE}/dists/unstable/main/binary-all/Packages --with-source ${APTARCHIVE}/dists/testing/main/binary-all/Packages