Skip to content

adb: fix broken adb_w_copy with ADB_TYPE_BLOB_16

Christian Marangi requested to merge Ansuel/apk-tools:fix-blob-16 into master

While continuing support for OpenWrt and implementing more and more package, it was notice a strange situation. With some specific package the installed database was getting corrupted.

The corruption was caused by a new line insert after a package description T: entry. The problem wasn't clear on it's own and I started investigating... By the looks of it, it really seemed a classic off-by one bug with for a string where len is miscalculated. But this was already strange since the string ends with a "." but that was missing and instead we had a new line.

With some additional test and numerous bisect of the code to validate that the string was correctly copied, it was notice that the problem wasn't really with the string handling but more with the length of it. Reducing to a max of 255 char, makes the problem disappear. Anything over 255 and the problem appear. With this new discovery it was also found that the new line that corrupts the database was just a coincidence and any other package with a long description had the last char corrupted.

Searching for special handling of length > of 255 made me discover that the service function "adb_w_copy" is broken.

Aside from the fact that, support for ADB_TYPE_BLOB_32 is missing, ADB_TYPE_BLOB_16 is actually very wrong.

Align variable is not set and even worse, the sz value is miscalculated as it should add 2 bytes on top of the read value instead of 1.

This was probably a copy paste error from ADB_TYPE_BLOB_8.

Setting the align value and assigning a correct sz fix the strange problem with long description caused by the broken adb_w_copy.

To prevent these kind of problem, also change ADB_TYPE_BLOB_8 pattern and not initialize align variable with a starting value so that static code analyzer might catch problem like this.

Signed-off-by: Christian Marangi ansuelsmth@gmail.com

Merge request reports

Loading