Only look for known tags, and ensure correct type and size where known before copying over. Bump the old arbitrary 16k count limit to 16M limit though, it's not inconceivable that a package could have that many files. While at it, ensure none of these tags exist in the main header, which would confuse us greatly.
This is optimized for backporting ease, upstream can remove redundancies and further improve checking later. Fixes: RhBug:1935049, RhBug:1933867, RhBug:1935035, RhBug:1934125, ... Fixes: CVE-2021-3421, CVE-2021-20271 You can view, comment on, or merge this pull request online at: https://github.com/rpm-software-management/rpm/pull/1577 -- Commit Summary -- * Be much more careful about copying data from the signature header -- File Changes -- M lib/package.c (114) -- Patch Links -- https://github.com/rpm-software-management/rpm/pull/1577.patch https://github.com/rpm-software-management/rpm/pull/1577.diff -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/rpm-software-management/rpm/pull/1577
_______________________________________________ Rpm-maint mailing list Rpm-maint@lists.rpm.org http://lists.rpm.org/mailman/listinfo/rpm-maint
