Skip to content
Permalink
Browse files

Avoid array index out of bounds parsing dpkg-deb --info

The first line of "dpkg-deb -I" output has only 5 words:
  old Debian package, version 0.939000.
or
  new Debian package, version 2.0.

Examples:

$ wget http://archive.debian.org/debian/dists/Debian-0.93R6/binary/admin/acct-5-10.deb
$ LANG=C dpkg-deb -I acct-5-10.deb
 old Debian package, version 0.939000.
 size 18338 bytes: control archive=1064, main archive=17260.
      61 bytes,     3 lines      conffiles
     889 bytes,    20 lines      control
     570 bytes,    23 lines   *  postinst             #!/bin/sh
     107 bytes,     7 lines   *  postrm               #!/bin/sh
     212 bytes,    12 lines   *  preinst              #!/bin/sh
     212 bytes,    12 lines   *  prerm                #!/bin/sh
...

$ wget http://archive.debian.org/debian/dists/bo/main/binary-all/admin/alien_3.3.deb
$ LANG=C dpkg-deb -I alien_3.3.deb
 new Debian package, version 2.0.
 size 20748 bytes: control archive=850 bytes.
     394 bytes,    11 lines      control
     785 bytes,    13 lines      md5sums
  • Loading branch information...
rbuj authored and raveit65 committed Feb 20, 2019
1 parent 333a9e9 commit db21779ec36d0415c37956325f5d1bcf4b89549f
Showing with 4 additions and 2 deletions.
  1. +4 −2 src/fr-command-dpkg.c
@@ -51,7 +51,7 @@ process_metadata_line (char *line,

g_return_if_fail (line != NULL);

fields = split_line (line, 6);
fields = split_line (line, 5);
if (!fields[1] || !g_str_equal (fields[1], "bytes,")) {
g_strfreev (fields);
return;
@@ -60,7 +60,9 @@ process_metadata_line (char *line,
fdata = file_data_new ();
fdata->size = g_ascii_strtoull (fields[0], NULL, 10);

if (fields[5] && g_str_equal (fields[4],"*")) {
if (g_str_equal (fields[4],"*")) {
g_strfreev (fields);
fields = split_line (line, 6);
name = g_strdup (fields[5]);
} else {
name = g_strdup (get_last_field (line, 5));

0 comments on commit db21779

Please sign in to comment.
You can’t perform that action at this time.