pkg/39593: pkg_delete crashes on RHEL 4.5/amd64

[rehsack%web.de@localhost]

>Number:         39593
>Category:       pkg
>Synopsis:       pkg_delete crashes on RHEL 4.5/amd64
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Sep 21 14:05:00 +0000 2008
>Originator:     Jens Rehsack
>Release:        none
>Organization:
Bayer Business Services
>Environment:
Linux byjk01 2.6.9-55.ELsmp #1 SMP Fri Apr 20 16:36:54 EDT 2007 x86_64 x86_64 
x86_64 GNU/Linux
>Description:
I can't tell the real reason for the crash, I assume somewhat like a compiler 
misbehaviour. In fact, I tried to update p5-XML-DOM-1.44 which causes 
pkg_delete to dump core.

A simple workaround is, just using the original buf pointer instead of the buf 
pointer, MD5File returns.
>How-To-Repeat:
(gdb) set args p5-XML-DOM-1.44
Breakpoint 1 at 0x40a667: file plist.c, line 564.
(gdb) run
Starting program: 
/opt/room/pkgsrc/pkgtools/pkg_install/work/pkg_install-20080423/delete/pkg_delete
 
p5-XML-DOM-1.44
Detaching after fork from child process 28344.
Detaching after fork from child process 28345.

Program received signal SIGSEGV, Segmentation fault.
0x0000002a957e0240 in strcmp () from /lib64/tls/libc.so.6
(gdb) bt
#0  0x0000002a957e0240 in strcmp () from /lib64/tls/libc.so.6
#1  0x000000000040a678 in delete_package (ign_err=0, nukedirs=0, 
pkg=Variable "pkg" is not available.
) at plist.c:564
#2  0x0000000000404019 in pkg_do (pkg=0x51f030 "p5-XML-DOM-1.44") at 
perform.c:789
#3  0x000000000040436e in pkg_perform (pkghead=0x51e3c0) at perform.c:880
#4  0x0000000000402859 in main (argc=5369872, argv=0x7fbffff7b8) at 
main.c:212Starting program: 
/opt/room/pkgsrc/pkgtools/pkg_install/work/pkg_install-20080423/delete/pkg_delete
 
p5-XML-DOM-1.44
(gdb) break plist.c:564
(gdb) R
Detaching after fork from child process 28381.
Detaching after fork from child process 28382.

Breakpoint 1, delete_package (ign_err=0, nukedirs=0, pkg=Variable "pkg" is 
not available.
) at plist.c:564
564                                                             if 
(strcmp(cp, p->next->name + ChecksumHeaderLen) != 0) {
(gdb) list
559                                             if (strncmp(p->next->name, 
CHECKSUM_HEADER, ChecksumHeaderLen) == 0) {
560                                                     char   *cp, 
buf[LegibleChecksumLen];
561 
562                                                     if ((cp = 
MD5File(tmp, buf)) != NULL) {
563                                                             /* 
Mismatch? */
564                                                             if 
(strcmp(cp, p->next->name + ChecksumHeaderLen) != 0) {
565 printf("original MD5 checksum failed, %s: %s\n",
566  Force ? "deleting anyway" : "not deleting", tmp);
567                                                                     if 
(!Force) {
568      fail = FAIL;
(gdb) print cp
$1 = 0xffffffffbfffb5c0 <Address 0xffffffffbfffb5c0 out of bounds>
(gdb) x tmp
0x7fbfffb5f0:   0x74706f2f
(gdb) print tmp
$2 = 
"/opt/pkgsrc/lib/perl5/vendor_perl/5.8.0/x86_64-linux-thread-multi/auto/XML-DOM/.packlist\000OM
 
2>/dev/null || true", '\0' <repeats 1705 times>, 
"\225*\000\000\000002A\000\000\000\000\000177\000\000\000\026\000\000\000\000\000\000\000Q\000\000\000\000\000002A\000\000\000\000\000%225*\000\000\0004000\000\000\000\000%225*",
 
'\0' <repeats 43 times>...
(gdb) print buf
$3 = "f3e60e29c2f51c21d37ddb04f33c10e8"
(gdb) print p
$4 = (plist_t *) 0x51f980
(gdb) q
The program is running.  Exit anyway? (y or n) y
>Fix:
Index: pkgtools/pkg_install/files/lib/plist.c
===================================================================
RCS file: /cvsroot/pkgsrc/pkgtools/pkg_install/files/lib/plist.c,v
retrieving revision 1.21
diff -u -u -r1.21 plist.c
--- pkgtools/pkg_install/files/lib/plist.c      17 Sep 2008 15:21:30 -0000      
1.21
+++ pkgtools/pkg_install/files/lib/plist.c      21 Sep 2008 13:49:37 -0000
@@ -572,7 +572,7 @@
 
                                                if ((cp = MD5File(tmp, buf)) != 
NULL) {
                                                        /* Mismatch? */
-                                                       if (strcmp(cp, 
p->next->name + ChecksumHeaderLen) != 0) {
+                                                       if (strcmp(buf, 
p->next->name + ChecksumHeaderLen) != 0) {
                                                                
printf("original MD5 checksum failed, %s: %s\n",
                                                                    Force ? 
"deleting anyway" : "not deleting", tmp);
                                                                if (!Force) {