libopkg: fix use-after-free with duplicate packages on the command line

[oweals/opkg-lede.git] / libopkg / opkg_download.c

diff --git a/libopkg/opkg_download.c b/libopkg/opkg_download.c
index 4969dd73692fd7da169da1db2284fcc7660d05c0..631bdabd4a3dee974fb54cdf3198a1f583bb4cdf 100644 (file)
--- a/libopkg/opkg_download.c
+++ b/libopkg/opkg_download.c
@@ -19,8 +19,10 @@
 
 #include "config.h"
 
+#include <sys/wait.h>
 #include <stdio.h>
 #include <unistd.h>
+#include <libgen.h>
 
 #include "opkg_download.h"
 #include "opkg_message.h"
@@ -81,7 +83,7 @@ str_starts_with(const char *str, const char *prefix)
 
 int
 opkg_download(const char *src, const char *dest_file_name,
-       curl_progress_func cb, void *data)
+       curl_progress_func cb, void *data, const short hide_error)
 {
     int err = 0;
 
@@ -141,7 +143,7 @@ opkg_download(const char *src, const char *dest_file_name,
        {
            long error_code;
            curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &error_code);
-           opkg_msg(ERROR, "Failed to download %s: %s.\n",
+           opkg_msg(hide_error?DEBUG2:ERROR, "Failed to download %s: %s.\n",
                    src, curl_easy_strerror(res));
            free(tmp_file_location);
            return -1;
@@ -195,7 +197,7 @@ opkg_download_cache(const char *src, const char *dest_file_name,
     int err = 0;
 
     if (!conf->cache || str_starts_with(src, "file:")) {
-       err = opkg_download(src, dest_file_name, cb, data);
+       err = opkg_download(src, dest_file_name, cb, data, 0);
        goto out1;
     }
 
@@ -214,10 +216,23 @@ opkg_download_cache(const char *src, const char *dest_file_name,
     if (file_exists(cache_location))
        opkg_msg(NOTICE, "Copying %s.\n", cache_location);
     else {
-       err = opkg_download(src, cache_location, cb, data);
-       if (err) {
-           (void) unlink(cache_location);
-           goto out2;
+       /* cache file with funky name not found, try simple name */
+        free(cache_name);
+        char *filename = strrchr(dest_file_name,'/');
+        if (filename)
+           cache_name = xstrdup(filename+1); // strip leading '/'
+        else
+           cache_name = xstrdup(dest_file_name);
+        free(cache_location);
+        sprintf_alloc(&cache_location, "%s/%s", conf->cache, cache_name);
+        if (file_exists(cache_location))
+           opkg_msg(NOTICE, "Copying %s.\n", cache_location);
+        else  {
+           err = opkg_download(src, cache_location, cb, data, 0);
+           if (err) {
+              (void) unlink(cache_location);
+              goto out2;
+         }
        }
     }
 
@@ -251,7 +266,7 @@ opkg_download_pkg(pkg_t *pkg, const char *dir)
 
     sprintf_alloc(&url, "%s/%s", pkg->src->value, pkg->filename);
 
-    /* XXX: BUG: The pkg->filename might be something like
+    /* The pkg->filename might be something like
        "../../foo.opk". While this is correct, and exactly what we
        want to use to construct url above, here we actually need to
        use just the filename part, without any directory. */
@@ -286,7 +301,7 @@ opkg_prepare_url_for_install(const char *url, char **namep)
          char *file_base = basename(file_basec);
 
          sprintf_alloc(&tmp_file, "%s/%s", conf->tmp_dir, file_base);
-         err = opkg_download(url, tmp_file, NULL, NULL);
+         err = opkg_download(url, tmp_file, NULL, NULL, 0);
          if (err)
               return err;
 
@@ -320,7 +335,7 @@ opkg_prepare_url_for_install(const char *url, char **namep)
      hash_insert_pkg(pkg, 1);
 
      if (namep) {
-         *namep = pkg->name;
+         *namep = xstrdup(pkg->name);
      }
      return 0;
 }
@@ -328,7 +343,28 @@ opkg_prepare_url_for_install(const char *url, char **namep)
 int
 opkg_verify_file (char *text_file, char *sig_file)
 {
-#if defined HAVE_GPGME
+#if defined HAVE_USIGN
+       int status = -1;
+       int pid;
+
+    if (conf->check_signature == 0 )
+        return 0;
+
+       pid = fork();
+       if (pid < 0)
+               return -1;
+
+       if (!pid) {
+               execl("/usr/sbin/opkg-key", "opkg-key", "verify", sig_file, text_file, NULL);
+               exit(255);
+       }
+
+       waitpid(pid, &status, 0);
+       if (!WIFEXITED(status) || WEXITSTATUS(status))
+               return -1;
+
+       return 0;
+#elif defined HAVE_GPGME
     if (conf->check_signature == 0 )
         return 0;
     int status = -1;
@@ -339,6 +375,8 @@ opkg_verify_file (char *text_file, char *sig_file)
     gpgme_signature_t s;
     char *trusted_path = NULL;
 
+    gpgme_check_version (NULL);
+
     err = gpgme_new (&ctx);
 
     if (err)