[Rpm-maint] [rpm-software-management/rpm] Tags in the signature header are not sorted (#181)

[Jeff Johnson]

Legacy compatibility well understood: not the first time tags were added out-of-order.

Meanwhile ...

You might want to consider checking whether tags are sorted as a side effect of calling hdrblobVerifyInfo() by comparing tagno's while traversing a region and skipping headerSort if/when tags are already sorted: qsort worst case behavior is on already sorted arrays, and there's already a linear "header sanity check" loop verification.

A check on sort order also helps detect fuzzed headers sooner.

See rpmdb/header_internal.c headerVerifyInfo() for the equivalent "header sanity check" code that detects ordering problems as well as specific tag damage from fuzzing. A single if statement there avoids the flaw above. I will likely extend headerVerifyInfo (as suggested) by adding an argument to avoid headerSort when not needed.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/issues/181#issuecomment-289429142
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20170327/f077f5be/attachment.html>