[Rpm-maint] [rpm-software-management/rpm] rpm crashes with PANIC when installing package with Lua scriptlet but missing `RPMVERSION` tag (Issue #4189)

[moedan]

moedan created an issue (rpm-software-management/rpm#4189)

**Describe the bug**
Installing an RPM package that contains a Lua scriptlet (e.g. `%pre -p <lua>`) but lacks the `RPMVERSION` header tag (1064) causes a crash with core dump.

This issue was introduced by #3270, which added the `RPM_PACKAGE_RPMVERSION` registry entry to `runLuaScript()`. The issue does not occur with RPM Version 4.19.x / 4.20.x.

**To Reproduce**
Steps to reproduce the behavior:
1. Build an RPM package with a Lua preinstall scriptlet using a third-party tool (e.g. [Java RPM Builder (maven Plugin)](https://github.com/ctron/rpm-builder)) that does not set the `RPMVERSION` tag (A prebuild example is added below).
2. Install the package: `rpm -ivh mwe-rpm-lua-problem-1.0.0-1.noarch.rpm`

A minimal RPM package to reproduce this issue is attached as zip file: [mwe-rpm-lua-problem-1.0.0-1.noarch.zip](https://github.com/user-attachments/files/26932329/mwe-rpm-lua-problem-1.0.0-1.noarch.zip)
 
**Expected behavior**
The package installs successfully, or rpm fails gracefully with a meaningful error message.

**Output**
The Lua scriptlet executes successfully, but immediately after, rpm crashes:

```bash
$ rpm -ivh mwe-rpm-lua-problem-1.0.0-1.noarch.rpm 
Verifying...                          ################################# [100%]
Preparing...                          ################################# [100%]
Hello World from preinstall lua scriptlet!
PANIC: unprotected error in call to Lua API (table index is nil)
Aborted                    (core dumped) rpm -ivh mwe-rpm-lua-problem-1.0.0-1.noarch.rpm
```

Backtrace:
```
#0  __pthread_kill_implementation () from /lib64/libc.so.6
#3  luaD_throw at ldo.c:129
#6  luaH_newkey at ltable.c:670
#9  lua_settable at lapi.c:865
#10 runLuaScript at rpmscript.cc:194
```

**Analysis**
The relevant code from the installed debug sources (`sed -n '180,210p' /usr/src/debug/rpm-6.0.1-1.fc43.x86_64/lib/rpmscript.cc`):

```c
mode_t oldmask = umask(0);
umask(oldmask);

lua_pushstring(L, "RPM_PACKAGE_RPMVERSION");        // line 183
lua_pushstring(L, script->rpmver);                  // line 184
lua_settable(L, LUA_REGISTRYINDEX);                 // line 185

if (chdir("/") == 0 &&
    rpmluaRunScript(lua, scriptbuf, script->descr, NULL, *argvp) == 0) {
    rc = RPMRC_OK;
}

lua_getfield(L, LUA_REGISTRYINDEX, "RPM_PACKAGE_RPMVERSION");    // line 192
lua_pushnil(L);                                                  // line 193
lua_settable(L, LUA_REGISTRYINDEX);                              // line 194 ← crash here

/* This failing would be fatal, return something different for it... */
if (fchdir(cwd)) {
    rpmlog(RPMLOG_ERR, _("Unable to restore current directory: %m"));
    rc = RPMRC_NOTFOUND;
}
close(cwd);
umask(oldmask);
```

At line 192, `lua_getfield` retrieves the value of `RPM_PACKAGE_RPMVERSION` from the Lua registry and pushes it onto the stack. This value is `nil`. At line 194, `lua_settable` then uses this `nil` value as a table key, which is illegal in Lua and causes the `PANIC` and abort.

The package was built without the `RPMVERSION` tag (1064), which is the likely reason for the `nil` value. Packages built with `rpmbuild` include the `RPMVERSION` tag and install without issues. Only packages from third-party tools that omit this tag are affected.

The issue affects any Lua scriptlet type (`%pretrans -p <lua>`, `%pre -p <lua>`, `%post -p <lua>`, etc.) since they all use the same `runLuaScript()` code path.

**Environment**
 - OS / Distribution: Fedora 43
 - Version: 6.0.1

**Additional context**
This issue is related to #3270.


-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/issues/4189
You are receiving this because you are subscribed to this thread.

Message ID: <rpm-software-management/rpm/issues/4189 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20260421/d3dc8ad8/attachment-0001.htm>