summaryrefslogtreecommitdiff
path: root/apt-pkg/contrib
Commit message (Collapse)AuthorAgeFilesLines
* OpProgress: Erase lines when doneJulian Andres Klode2024-04-121-4/+7
| | | | | | | | | | | It's interesting to the user to see the progress when it happens, but arguably once it's done it is just visual clutter, so let's not write newlines, and when we are done, instead of appending "Done", let's just empty the line. This requires some effort to keep apt-cdrom happy which just writes lines to stdout itself. Bad apt-cdrom. Maybe there is a better fix for it, but this gets us going.
* Handle EINTR in the static FileFd::Write overloadDavid Kalnischkies2024-03-051-39/+32
| | | | | | | | | | While the code claims to handle it by just continuing the loop, the looping condition will actually cause a break from the loop failing the interrupted writing. The non-static FileFd::Write (and ::Read) deal with this by setting acceptable values for the loop condition as well – but for more simplicity and consistency we can instead remove this extra loop condition and perform the continue/break due to error handling more explicitly.
* Modernize standard library includesJulian Andres Klode2024-02-2018-58/+57
| | | | | | This was automated with sed and git-clang-format, and then I had to fix up the top of policy.cc by hand as git-clang-format accidentally indented it by two spaces.
* Merge branch 'prevent_read_conf_inf_loop' into 'main'Julian Andres Klode2024-02-201-1/+1
|\ | | | | | | | | Prevent infinite loop in `ReadConfigFile` See merge request apt-team/apt!314
| * Prevent infinite loop in `ReadConfigFile`Adam Saponara2023-12-291-1/+1
| | | | | | | | | | Break the loop on failure. Without this, the function goes into an infinite loop if `FName` is a directory.
* | Do not silently ignore directories for reserved file namesJulian Andres Klode2023-12-131-3/+5
|/ | | | | | Files with reserved extensions like .list, .sources, .conf, and .pref should receive notices in their respective directories even if they are directories.
* Revert "Do not fail on systems running in FIPSmode."Julian Andres Klode2023-10-041-3/+0
| | | | This reverts commit 668451def296afeb0c358a7d80ff39dc546defab.
* Do not fail on systems running in FIPSmode.A. Maitland Bottoms2023-05-291-0/+3
| | | | | Initialize using gcrypt's GCRYCTL_NO_FIPS_MODE, available since gcrypt version 1.10.0, otherwise apt aborts on FIPS enabled systems.
* Address statements of public domainJulian Andres Klode2023-03-0612-2/+54
|
* Include cstdint for uint16_t in our mmap wrappingDavid Kalnischkies2023-01-291-0/+1
| | | | | | | In gcc-13 internal includes were reduced exposing our laziness. Reported-By: gcc-13 Gbp-Dch: Ignore
* Merge branch 'musl' into 'main'Julian Andres Klode2022-09-211-0/+1
|\ | | | | | | | | apt-pkg/contrib/fileutl.h Explicitly include sys/stat.h See merge request apt-team/apt!255
| * apt-pkg/contrib/fileutl.h Explicitly include sys/stat.hlancethepants2022-08-261-0/+1
| | | | | | | | This fixes compatibility with musl C library.
* | typecast time_t and suseconds_t from std::chronoKhem Raj2022-09-161-1/+1
|/ | | | | | | | This fixes build on some architectures like mips progress.cc:125:31: error: non-constant-expression cannot be narrowed from type 'std::chrono::duration<long long>::rep' (aka 'long long') to '__time_t' (aka 'long') in initializer list [-Wc++11-narrowing] struct timeval NowTime = { Now_sec.count(), Now_usec.count() }; Signed-off-by: Khem Raj <raj.khem@gmail.com>
* Fix integer underflow in flExtensionRonan Desplanques2022-05-231-1/+1
| | | | | | | | | | | Before this patch, the expression `Res - File.length()` that was used as the length underflowed. It was very unlikely to cause any problem given the saturating behavior of the std::string constructor that's used. Replacing `Res - File.length()` with `File.length() - Res` would have worked, but omitting the last argument altogether invokes an std::string constructor which does the right thing.
* Include our config.h in all C++ files to avoid ODR violationsDavid Kalnischkies2022-05-071-0/+2
| | | | | | | Some of our headers use APT_COMPILING_APT trickery to avoid exposing too broadly details we don't want external clients to know and make use of. The flip-side is that this can lead to different compilation units seeing different definitions if they aren't all using the same config.
* Remove unused public zlib include from libapt fileutl.hDavid Kalnischkies2022-05-071-3/+0
| | | | | | | | Our public interface doesn't use zlib for quite a while now so lets drop the last remnants as hopefully nobody depends on us bringing it in… Unlike our own private lib for transitive provision of unistd.h. References: 680b916ce7203a40ebd0a3882b9a71ca77278a67
* Parse Checksum fields via pkgTagSection::Key, tooDavid Kalnischkies2022-04-012-0/+25
| | | | | | | We abstract hashes a fair bit to be able to add new ones eventually, which lead us to building the field names on the fly. We can do better through by keeping a central place for these names, too, which even helps in reducing code as we don't need the MD5 → Files dance anymore.
* Document tagfile-keys.h as internal to aptDavid Kalnischkies2022-04-011-0/+3
| | | | | | | | | | | | | | | | The previous regime of the file was to sort it on insert, but that changes the values in the generated enum, which is fine as long as we only use it in libapt itself, but breaks on other users. The header was always intended to be private to apt itself, so we just document this here now and lay the ground work to have the file in the future only appended to, so that it remains sufficiently ABI stable that we can use it outside the library in our apt tools. We also remove some fields apt is unlikely to need or only uses in certain cases outside of any (speed) critical path to have enough room to add more fields soon as currently we are limited to 128 fields max and it would be sad if we use up that allowance entirely already.
* Introduce and use isalpha_ascii() in debversion rather than isalpha()Julian Andres Klode2022-01-061-0/+15
| | | | | Avoid misclassifying additional alphabetical characters from certain locales as alpha and then sort them by ASCII...
* Spelling fixesVille Skyttä2021-11-272-2/+2
|
* apt-pkg/contrib/srvrec.h: Explicitly include sys/types.hAlexander Kanavin2021-11-221-0/+1
| | | | This avoids type errors with musl C library.
* srvrec: Keep support for older resolverKhem Raj2021-03-201-0/+7
| | | | | | | | | Some C libraries e.g. musl do not implement the new res_n* APIs therefore keep the old implementation as fallback and check __RES version macro to determine the API level Signed-off-by: Khem Raj <raj.khem@gmail.com> Cc: Julian Andres Klode <julian.klode@canonical.com>
* RunScripts: Do not reset SIGQUIT and SIGINT to SIG_DFLJulian Andres Klode2021-03-011-4/+0
| | | | | | | | | | | This caused python-apt to unset the Python signal handler when running update or install commands, breaking KeyboardInterrupt amongst possibly other things. We do not set those signal handlers in this functions, and the calling functions restore signal handlers to previous ones. LP: #1898026
* configuration: Add missing #include <array>Julian Andres Klode2021-02-241-0/+1
| | | | | | | | | | | | | | As user "DaOfficialRolex" on GitHub pointed out: This is needed to allow for APT on iOS to compile correctly. If not included the two following errors happen while compiling APT. ~/apt/apt-pkg/contrib/configuration.cc:900:44: error: constexpr variable cannot have non-literal type 'const std::array<APT::StringView, 3>' constexpr std::array<APT::StringView, 3> magicComments { "clear"_sv, "include"_sv, "x-apt-configure-index"_sv }; ^ ~/apt/apt-pkg/contrib/configuration.cc:900:44: error: implicit instantiation of undefined template 'std::__1::array<APT::StringView, 3>' /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/../include/c++/v1/__tuple:219:64: note: template is declared here template <class _Tp, size_t _Size> struct _LIBCPP_TEMPLATE_VIS array; ^
* Replace PrintStatus with SendMessage usageDavid Kalnischkies2021-02-043-21/+7
| | | | | | | varg API is a nightmare as the symbols seems different on ever other arch, but more importantly SendMessage does a few checks on the content of the message and it is all outputted via C++ iostreams and not mixed in FILE* which is handy for overriding the streams.
* Avoid undefined pointer arithmetic while growing mmapDavid Kalnischkies2021-02-041-1/+1
| | | | | | | | | The undefined behaviour sanitizer complains with: runtime error: addition of unsigned offset to 0x… overflowed to 0x… Compilers and runtime do the right thing in any case and it is a codepath that can (and ideally should) be avoided for speed reasons alone, but fixing it can't hurt (too much).
* Avoid overstepping bounds in config file parsingDavid Kalnischkies2021-02-032-60/+80
| | | | | | | Our configuration files are not security relevant, but having a parser which avoids crashing on them even if they are seriously messed up is not a bad idea anyway. It is also a good opportunity to brush up the code a bit avoiding a few small string copies with our string_view.
* Forbid negative values in unsigned StrToNum explicitlyDavid Kalnischkies2021-02-031-25/+16
| | | | | | | strtoul(l) surprises us with parsing negative values which should not exist in the places we use to parse them, so we can just downright refuse them rather than trying to work with them by having them promoted to huge positive values.
* Remove Word size limit from ParseQuote and CWordDavid Kalnischkies2021-02-031-26/+17
| | | | | | It isn't super likely that we will encounter such big words in the real world, but we can return arbitrary length, so lets just do that as that also means we don't have to work with a second buffer.
* Don't parse \x and \0 past the end in DeEscapeStringDavid Kalnischkies2021-02-031-4/+8
| | | | | | This has no attack surface though as the loop is to end very soon anyhow and the method only used while reading CD-ROM mountpoints which seems like a very unlikely attack vector…
* Fix incorrect base64 encoding due to int promotionDavid Kalnischkies2021-02-031-1/+1
| | | | | | | For \xff and friends with the highest bit set and hence being a negative value on signed char systems the wrong encoding is produced as we run into undefined behaviour accessing negative array indexes. We can avoid this problem simply by using an unsigned data type.
* Retire and deprecate _strtabexpandDavid Kalnischkies2021-02-032-21/+3
| | | | | | | | If the Configuration code calling this was any indication, it is hard to use – and even that monster still caused heap-buffer-overflow errors, so instead of trying to fix it, lets just use methods which are far easier to use. The question why this is done at all remains, but is left for another day as an exercise for the reader.
* Fail ConfigDir reading if directory listing failedDavid Kalnischkies2021-02-031-1/+4
| | | | | | We were printing an error and hence have non-zero exit code either way, but API wise it makes sense to have this properly reported back to the caller to propagate it down the chain e.g. while parsing #include stanzas.
* Use 500 MB memory limit for xz/lzma decodingDavid Kalnischkies2021-02-021-15/+6
| | | | | | | | | | | | The buffers we feed in and read out are usually a couple kilobytes big so allowing lzma to use an unlimited amount of memory is easy & okay, but not needed and confuses memory checkers as it will cause lzma to malloc a huge chunk of memory (which it will never use). So lets just use a "big enough" value instead. In exchange we simplify the decoder calling as we were already using the auto-variant for xz, so we can just avoid the if-else and let liblzma decide what it decodes.
* CVE-2020-27350: tarfile: integer overflow: Limit tar items to 128 GiBJulian Andres Klode2020-12-091-0/+10
| | | | | | | | | | | | | | | | | | | The integer overflow was detected by DonKult who added a check like this: (std::numeric_limits<decltype(Itm.Size)>::max() - (2 * sizeof(Block))) Which deals with the code as is, but also still is a fairly big limit, and could become fragile if we change the code. Let's limit our file sizes to 128 GiB, which should be sufficient for everyone. Original comment by DonKult: The code assumes that it can add sizeof(Block)-1 to the size of the item later on, but if we are close to a 64bit overflow this is not possible. Fixing this seems too complex compared to just ensuring there is enough room left given that we will have a lot more problems the moment we will be acting on files that large as if the item is that large, the (valid) tar including it probably doesn't fit in 64bit either.
* tarfile: OOM hardening: Limit size of long names/links to 1 MiBJulian Andres Klode2020-12-091-1/+10
| | | | | | | | | | | | | | | Tarballs have long names and long link targets structured by a special tar header with a GNU extension followed by the actual content (padded to 512 bytes). Essentially, think of a name as a special kind of file. The limit of a file size in a header is 12 bytes, aka 10**12 or 1 TB. While this works OK-ish for file content that we stream to extractors, we need to copy file names into memory, and this opens us up to an OOM DoS attack. Limit the file name size to 1 MiB, as libarchive does, to make things safer.
* CVE-2020-27350: arfile: Integer overflow in parsingJulian Andres Klode2020-12-091-1/+13
| | | | | | | | | | | | | | | | | | | | | | GHSL-2020-169: This first hunk adds a check that we have more files left to read in the file than the size of the member, ensuring that (a) the number is not negative, which caused the crash here and (b) ensures that we similarly avoid other issues with trying to read too much data. GHSL-2020-168: Long file names are encoded by a special marker in the filename and then the real filename is part of what is normally the data. We did not check that the length of the file name is within the length of the member, which means that we got a overflow later when subtracting the length from the member size to get the remaining member size. The file createdeb-lp1899193.cc was provided by GitHub Security Lab and reformatted using apt coding style for inclusion in the test case, both of these issues have an automated test case in test/integration/test-ubuntu-bug-1899193-security-issues. LP: #1899193
* HexDigest: Silence -Wstringop-overflowJulian Andres Klode2020-12-041-0/+1
| | | | | | | | | | | | | | | | | | | | | The compiler does not know that the size is small and thinks we might be doing a stack buffer overflow of the vla: Add APT_ASSUME macro and silence -Wstringop-overflow in HexDigest() The compiler does not know that the size of a hash is at most 512 bit, so tell it that it is. ../apt-pkg/contrib/hashes.cc: In function ‘std::string HexDigest(gcry_md_hd_t, int)’: ../apt-pkg/contrib/hashes.cc:415:21: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=] 415 | Result[(Size)*2] = 0; | ~~~~~~~~~~~~~~~~~^~~ ../apt-pkg/contrib/hashes.cc:414:9: note: at offset [-9223372036854775808, 9223372036854775807] to an object with size at most 4294967295 declared here 414 | char Result[((Size)*2) + 1]; | ^~~~~~ Fix this by adding a simple assertion. This generates an extra two instructions in the normal code path, so it's not exactly super costly.
* Merge branch 'pu/less-slaves' into 'master'Julian Andres Klode2020-08-041-1/+1
|\ | | | | | | | | Remove master/slave terminology See merge request apt-team/apt!124
| * Replace whitelist/blacklist with allowlist/denylistJulian Andres Klode2020-08-041-1/+1
| |
* | Merge branch 'pu/apt-key-deprecated' into 'master'Julian Andres Klode2020-08-041-0/+3
|\ \ | |/ |/| | | | | Fully deprecate apt-key, schedule removal for Q2/2022 See merge request apt-team/apt!119
| * Fully deprecate apt-key, schedule removal for Q2/2022Julian Andres Klode2020-05-061-0/+3
| | | | | | | | | | | | | | | | | | People are still using apt-key add and friends, despite that not being guaranteed to work. Let's tell them to stop doing so. We might still want a list command at a future point, but this needs deciding, and a blanket ban atm seems like a sensible step until we figured that out.
* | Reorder config check before result looping for SRV parsing debugDavid Kalnischkies2020-07-021-11/+6
| | | | | | | | | | It isn't needed to iterate over all results if we will be doing nothing anyhow as it isn't that common to have that debug option enabled.
* | Skip reading data from tar members if nobody will look at itDavid Kalnischkies2020-05-181-28/+28
| | | | | | | | | | | | | | | | The variable this is read to is named Junk and that it is for usecases like apt-ftparchive which just looks at the items metadata, so instead of performing this hunked read for data nobody will process we just tell our FileFd to skip ahead (Internally it might still loop over the data depending on which compressor is involved).
* | Properly handle interrupted write() call in ExtractTarDavid Kalnischkies2020-05-181-1/+1
| | | | | | | | | | | | With FileFd::Write we already have a helper for this situation we can just make use of here instead of hoping for the best or rolling our own solution here.
* | Allow prefix to be a complete filename for GetTempFileDavid Kalnischkies2020-05-181-12/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | Our testcases had their own implementation of GetTempFile with the feature of a temporary file with a choosen suffix. Merging this into GetTempFile lets us drop this duplicate and hence test more our code rather than testing our helpers for test implementation. And then hashsums_test had another implementation… and extracttar wasn't even trying to use a real tempfile… one GetTempFile to rule them all! That also ensures that these tempfiles are created in a temporary directory rather than the current directory which is a nice touch and tries a little harder to clean up those tempfiles.
* | Prefer use of O_TMPFILE in GetTempFile if availableDavid Kalnischkies2020-05-181-5/+12
| | | | | | | | | | Not all filesystems implement this feature in all versions of Linux, so this open call can fail & we have to fallback to our old method.
* | SECURITY UPDATE: Fix out of bounds read in .ar and .tar implementation ↵Julian Andres Klode2020-05-122-3/+10
|/ | | | | | | | | | | | | | | | | | | | | (CVE-2020-3810) When normalizing ar member names by removing trailing whitespace and slashes, an out-out-bound read can be caused if the ar member name consists only of such characters, because the code did not stop at 0, but would wrap around and continue reading from the stack, without any limit. Add a check to abort if we reached the first character in the name, effectively rejecting the use of names consisting just of slashes and spaces. Furthermore, certain error cases in arfile.cc and extracttar.cc have included member names in the output that were not checked at all and might hence not be nul terminated, leading to further out of bound reads. Fixes Debian/apt#111 LP: #1878177
* Add color highlighting to E:/W:/N: prefixesJulian Andres Klode2020-03-241-0/+46
| | | | | | This matches the definitions used by dpkg. Closes: #953527
* error: Extract operator<< into error.cc (de-inline it)Julian Andres Klode2020-03-102-25/+45
| | | | | Extract the code, and reformat it with clang-format so we can modify it.
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2026-05-12 16:47:00 +0000