Package: dpkg
Version: 1.15.8.10 1.16.0.3
Severity: important
File: /usr/bin/update-alternatives
Tags: squeeze sid

I just managed to corrupt the alternatives database using the
update-alternatives command, see
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631496
The following small script does the job reproducible:

===== corrupt-alternatives.sh =====
#!/bin/sh
#set -e
set -x

master=${1:-master}

touch /tmp/lo /tmp/hi /tmp/slave1 /tmp/slave2

update-alternatives --install /tmp/$master $master /tmp/lo 1 --slave 
/tmp/$master-slave slave1 /tmp/slave1
update-alternatives --install /tmp/$master $master /tmp/hi 2 --slave 
/tmp/$master-slave slave2 /tmp/slave2

update-alternatives --display $master

update-alternatives --remove $master /tmp/lo
update-alternatives --remove $master /tmp/hi

update-alternatives --display $master

update-alternatives --remove-all $master

update-alternatives --display $master
==========

# ./corrupt-alternatives.sh test1
+ master=test1
+ touch /tmp/lo /tmp/hi /tmp/slave1 /tmp/slave2
+ update-alternatives --install /tmp/test1 test1 /tmp/lo 1 --slave 
/tmp/test1-slave slave1 /tmp/slave1
update-alternatives: using /tmp/lo to provide /tmp/test1 (test1) in auto mode.
+ update-alternatives --install /tmp/test1 test1 /tmp/hi 2 --slave 
/tmp/test1-slave slave2 /tmp/slave2
update-alternatives: using /tmp/hi to provide /tmp/test1 (test1) in auto mode.
+ update-alternatives --display test1
update-alternatives: error: /var/lib/dpkg/alternatives/test1 corrupt: duplicate 
slave link /tmp/test1-slave
+ update-alternatives --remove test1 /tmp/lo
update-alternatives: error: /var/lib/dpkg/alternatives/test1 corrupt: duplicate 
slave link /tmp/test1-slave
+ update-alternatives --remove test1 /tmp/hi
update-alternatives: error: /var/lib/dpkg/alternatives/test1 corrupt: duplicate 
slave link /tmp/test1-slave
+ update-alternatives --display test1
update-alternatives: error: /var/lib/dpkg/alternatives/test1 corrupt: duplicate 
slave link /tmp/test1-slave
+ update-alternatives --remove-all test1
update-alternatives: error: /var/lib/dpkg/alternatives/test1 corrupt: duplicate 
slave link /tmp/test1-slave
+ update-alternatives --display test1
update-alternatives: error: /var/lib/dpkg/alternatives/test1 corrupt: duplicate 
slave link /tmp/test1-slave

The problem is that the "duplicate slave" is inserted into the database
without proper checking and any further operation on this alternative
fails. The database it not recoverable by
'update-alternatives --remove-all <broken-alternative>'

The problem is reproducible in sid and squeeze, but not in lenny (which
had the perl implementation of update-alternatives) - the duplicate is
detected before inserting it into the database.


Andreas

-- System Information:
Debian Release: 6.0.1
  APT prefers stable
  APT policy: (800, 'stable'), (700, 'testing'), (600, 'unstable'), (500, 
'stable-updates'), (130, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.32-5-amd64 (SMP w/4 CPU cores)
Locale: LANG=C, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages dpkg depends on:
ii  coreutils               8.5-1            GNU core utilities
ii  libbz2-1.0              1.0.5-6          high-quality block-sorting file co
ii  libc6                   2.13-7           Embedded GNU C Library: Shared lib
ii  libselinux1             2.0.96-1         SELinux runtime shared libraries
ii  xz-utils                5.0.0-2          XZ-format compression utilities
ii  zlib1g                  1:1.2.3.4.dfsg-3 compression library - runtime

dpkg recommends no packages.

Versions of packages dpkg suggests:
ii  apt                           0.8.10.3   Advanced front-end for dpkg

-- no debconf information



-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org

Reply via email to