Bug#902643: buggy magic: dump previous vs current swapped

[Elliott Mitchell]

On Mon, May 18, 2020 at 10:56:06AM +0200, Christoph Biedl wrote:
> Elliott Mitchell wrote...
> > (for the level 0 is is reporting the epoch,
> > "never", "none", or "No previous dump" would be better).  Also noticing
> > for the level 0 is is reporting "Level zero" instead of "Level 0".
> 
> That's arguable. About the timestamp, the program just dumps the value
> zero which gets printed as the epoch. The literal "zero" however is
> result of an extra rule in libmagic's patterns. Personally, I'd either
> have such an extra for either both cases or none at all. Any mix seems
> weird.

Perhaps.  I'm going by the way /I/ read things and *both* seem wrong due
to different interpretation.

For the "Level" field the value is a base 10 number unless the value is
0.  If one was writing a script which identified dump files the Level
field is excellent, except for having "zero" instead of "0".

The "Previous dump" field won't ever display as 0.  Displaying the epoch
is valid, though suboptimal for humans and would need special handling
for scripts.  As this is a string, having "No previous dump" or omitting
the field would likely cause a script to save an empty string for the
value which seems likely to result in correct behavior.

Of the two, having "Level 0" seems, by far, the more important issue
since it screws up both humans and scripts.

Let us not forget the original report was the values for "This dump" and
"Previous dump" are interchanged.


-- 
(\___(\___(\__  --=> 8-) EHM <=--  __/)___/)___/)
 \BS (| ehem+sig...@m5p.com  PGP 87145445 |)   /
  \_CS\   |  _  -O #include  O-   _  |   /  _/
8A19\___\_|_/58D2 7E3D DDF4 7BA6 <-PGP-> 41D1 B375 37D0 8714\_|_/___/5445

Bug#902643: buggy magic: dump previous vs current swapped

[Christoph Biedl]

# upstream commit FILE5_33-59-g4fdbc347 

Control: found 902643 1:5.30-1+deb9u3
Control: fixed 902643 1:5.34-1

Elliott Mitchell wrote...

> Sample invocation of `dump` might be `dump -u0 -f fs_dump.0 /dev/loop0`
> and then `dump -u1 -f fs_dump.1 /dev/loop0`.  Examine the output of
> `file fs_dump.0` and `file fs_dump.1`.  The dates for the previous dump
> and current dump are swapped (...)

*That* is the information needed to start working on a report. So this
exists in stretch only, I'll try to include it in another point release.

> (for the level 0 is is reporting the epoch,
> "never", "none", or "No previous dump" would be better).  Also noticing
> for the level 0 is is reporting "Level zero" instead of "Level 0".

That's arguable. About the timestamp, the program just dumps the value
zero which gets printed as the epoch. The literal "zero" however is
result of an extra rule in libmagic's patterns. Personally, I'd either
have such an extra for either both cases or none at all. Any mix seems
weird.

Christoph


signature.asc
Description: PGP signature

Bug#902643: buggy magic: dump previous vs current swapped

[Elliott Mitchell]

On Sun, May 17, 2020 at 08:06:58AM +0200, Christoph Biedl wrote:
> Elliott Mitchell wrote...
> 
> > SSIA.  When examining files produced by `dump` it gives a date for the
> > current file and the date of the previous dump.  Unfortunately the date
> > it is giving for the "Previous dump" is the date on the file being
> > examined, whereas the date for "This dump" is the date of the previous
> > dump.

> Debian package search for "dump" returns
> 
> /etc/comgt/dumpcomgt
> /sbin/dump dump
> /usr/lib//dist-packages/cdist/conf/type/__mount/parameter/default/dump
>   cdist
> /usr/lib//dumpcorekeeper
> /usr/lib//filters-unex/dump   cruft-common
> /usr/lib//gwyddion/plugins/file/dump  gwyddion-plugins
> /usr/lib//metview/dumpmetview
> /usr/lib//planners/dump   apt
> /usr/lib//solvers/dumpapt
> 
> And libmagic has 69 lines that result in a string containing "dump".
> Quite frankly, I'm lost here. Which one of those are you referring to?
> How can I reproduce the issue?

Notice only one of those has a *package* *name* of "dump" and the utility
itself is "/sbin/dump" (and it is executeable).

Sample invocation of `dump` might be `dump -u0 -f fs_dump.0 /dev/loop0`
and then `dump -u1 -f fs_dump.1 /dev/loop0`.  Examine the output of
`file fs_dump.0` and `file fs_dump.1`.  The dates for the previous dump
and current dump are swapped (for the level 0 is is reporting the epoch,
"never", "none", or "No previous dump" would be better).  Also noticing
for the level 0 is is reporting "Level zero" instead of "Level 0".


-- 
(\___(\___(\__  --=> 8-) EHM <=--  __/)___/)___/)
 \BS (| ehem+sig...@m5p.com  PGP 87145445 |)   /
  \_CS\   |  _  -O #include  O-   _  |   /  _/
8A19\___\_|_/58D2 7E3D DDF4 7BA6 <-PGP-> 41D1 B375 37D0 8714\_|_/___/5445

Bug#902643: buggy magic: dump previous vs current swapped

[Christoph Biedl]

Control: tags 902643 moreinfo

Elliott Mitchell wrote...

> SSIA.  When examining files produced by `dump` it gives a date for the
> current file and the date of the previous dump.  Unfortunately the date
> it is giving for the "Previous dump" is the date on the file being
> examined, whereas the date for "This dump" is the date of the previous
> dump.

Hi there,

Debian package search for "dump" returns

/etc/comgt/dumpcomgt
/sbin/dump dump
/usr/lib//dist-packages/cdist/conf/type/__mount/parameter/default/dump 
 cdist
/usr/lib//dumpcorekeeper
/usr/lib//filters-unex/dump   cruft-common
/usr/lib//gwyddion/plugins/file/dump  gwyddion-plugins
/usr/lib//metview/dumpmetview
/usr/lib//planners/dump   apt
/usr/lib//solvers/dumpapt

And libmagic has 69 lines that result in a string containing "dump".
Quite frankly, I'm lost here. Which one of those are you referring to?
How can I reproduce the issue?

Christoph


signature.asc
Description: PGP signature

Bug#902643: buggy magic: dump previous vs current swapped

[Elliott Mitchell]

Package: file
Version: 1:5.30-1+deb9u1

SSIA.  When examining files produced by `dump` it gives a date for the
current file and the date of the previous dump.  Unfortunately the date
it is giving for the "Previous dump" is the date on the file being
examined, whereas the date for "This dump" is the date of the previous
dump.

I find it odd that level 1 or level 2 dumps generate "Level 1" or
"Level 2" in `file`'s output, whereas level 0 gets "Level zero"
(consistent use of arabic or localized units would be handy).


-- 
(\___(\___(\__  --=> 8-) EHM <=--  __/)___/)___/)
 \BS (| ehem+sig...@m5p.com  PGP 87145445 |)   /
  \_CS\   |  _  -O #include  O-   _  |   /  _/
8A19\___\_|_/58D2 7E3D DDF4 7BA6 <-PGP-> 41D1 B375 37D0 8714\_|_/___/5445