Couple fixes in rpmdb (double free, and rpmdbCheckTerminate return code)

[glebfm]

This code:

#include <rpm/rpmdb.h>
#include <rpm/rpmts.h>
#include <rpm/rpmlib.h>
#include <signal.h>

class A {
    private:
        rpmts ts;
        rpmdbMatchIterator mi;
    public:
        A() {
            rpmReadConfigFiles(NULL, NULL);
            ts = rpmtsCreate();
            mi = rpmtsInitIterator(ts, RPMDBI_PACKAGES, NULL, 0);
        };
        ~A() {
            rpmdbFreeIterator(mi);
            rpmtsFree(ts);
        };
};

A a;

int main() {
    raise(SIGTERM);
    rpmdbCheckSignals();
    return 0;
}

tries to free MatchIterator again in atexit destructor.

Program received signal SIGSEGV, Segmentation fault.
#0  0x00007ffff7b57c17 in ?? () from /usr/lib64/librpm.so.7
#1  0x00007ffff7b5fbaa in rpmdbFreeIterator () from /usr/lib64/librpm.so.7
#2  0x00000000004009b6 in A::~A (this=0x601080 <a>, __in_chrg=<optimized out>) at t.cc:17
#3  0x00007ffff77d1ca8 in __run_exit_handlers (status=1, listp=0x7ffff7b395d8 <__exit_funcs>, run_list_atexit=run_list_atexit@entry=true) at exit.c:82
#4  0x00007ffff77d1cf5 in __GI_exit (status=<optimized out>) at exit.c:104
#5  0x00007ffff7b5f513 in rpmdbCheckSignals () from /usr/lib64/librpm.so.7
#6  0x00000000004008e9 in main () at t.cc:26

I tried if (rpmdbCheckTerminate(0) == 0) rpmdbFreeIterator(mi);, but rpmdbCheckTerminate return code is not reliable.

[ignatenkobrain]

Looks nice, indeed!

[Conan-Kudo]

Looks good to me as well. 👍

[rpm-maint]

On 09/19/2016 07:33 PM, Gleb Pfotenhauer-Malinowski wrote:

This code:

#include <rpm/rpmdb.h>
#include <rpm/rpmts.h>
#include <rpm/rpmlib.h>
#include <signal.h>

class A {
    private:
        rpmts ts;
        rpmdbMatchIterator mi;
    public:
        A() {
            rpmReadConfigFiles(NULL, NULL);
            ts = rpmtsCreate();
            mi = rpmtsInitIterator(ts, RPMDBI_PACKAGES, NULL, 0);
        };
        ~A() {
            rpmdbFreeIterator(mi);
            rpmtsFree(ts);
        };
};

A a;

int main() {
    raise(SIGTERM);
    rpmdbCheckSignals();
    return 0;
}

tries to free MatchIterator again in atexit destructor.

Program received signal SIGSEGV, Segmentation fault.
#0 0x00007ffff7b57c17 in ?? () from /usr/lib64/librpm.so.7
#1 0x00007ffff7b5fbaa in rpmdbFreeIterator () from /usr/lib64/librpm.so.7
#2 0x00000000004009b6 in A::~A (this=0x601080 , __in_chrg=) at t.cc:17
#3 0x00007ffff77d1ca8 in __run_exit_handlers (status=1, listp=0x7ffff7b395d8 <__exit_funcs>, run_list_atexit=run_list_atexit@entry=true) at exit.c:82
#4 0x00007ffff77d1cf5 in __GI_exit (status=) at exit.c:104
#5 0x00007ffff7b5f513 in rpmdbCheckSignals () from /usr/lib64/librpm.so.7
#6 0x00000000004008e9 in main () at t.cc:26

I tried if (rpmdbCheckTerminate(0) == 0) rpmdbFreeIterator(mi);, but rpmdbCheckTerminate return code is not reliable.
You can view, comment on, or merge this pull request online at:

#92

-- Commit Summary --

• rpmdb.c: avoid double free in rpmdbClose, rpmdbMatchIterator, ...
• rpmdb.c: (rpmdbCheckTerminate) return non-zero on subsequent runs

-- File Changes --

M lib/rpmdb.c (17)

-- Patch Links --

https://github.com/rpm-software-management/rpm/pull/92.patch
https://github.com/rpm-software-management/rpm/pull/92.diff

Wow, that sounds like a fix for this rather ancient issue that I guess
nobody ever properly investigated:
https://www.redhat.com/archives/rpm-list/2002-November/msg00230.html

- Panu -

[ffesti]

Nice catch! Always amazing what ancient bugs can still be found in even very basic code paths... sigh

Anyway. Thanks a lot for hunting this down. Pushed.