diff options
| author | Jo-Philipp Wich | 2019-01-31 07:29:22 +0000 |
|---|---|---|
| committer | Jo-Philipp Wich | 2019-01-31 07:39:18 +0000 |
| commit | cb6640381808dd629cfa58a21ceaf12e91a82e68 (patch) | |
| tree | 39055e3d3623bdbaffed27a7bef39cc1aed268ca | |
| parent | 7708a01a084872bbe4c46f36d2da021fdeb10862 (diff) | |
| download | opkg-lede-cb6640381808dd629cfa58a21ceaf12e91a82e68.tar.gz | |
libopkg: check for file size mismatches
Reject package files whose file size deviates from the size specified
in the package index in order to complicate producing hash collisions.
Ref: https://groups.google.com/d/msg/opkg-devel/o4kiGQMvkiw/hu0TVv59DgAJ
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
| -rw-r--r-- | libopkg/opkg_install.c | 24 |
1 files changed, 24 insertions, 0 deletions
diff --git a/libopkg/opkg_install.c b/libopkg/opkg_install.c index d2d919a..0b7f1f1 100644 --- a/libopkg/opkg_install.c +++ b/libopkg/opkg_install.c @@ -1255,6 +1255,7 @@ int opkg_install_pkg(pkg_t * pkg, int from_upgrade) char *file_sha256, *pkg_sha256; sigset_t newset, oldset; const char *local_filename; + struct stat pkg_stat; time_t now; if (from_upgrade) @@ -1366,6 +1367,29 @@ int opkg_install_pkg(pkg_t * pkg, int from_upgrade) } #endif + /* Check file size */ + err = lstat(local_filename, &pkg_stat); + + if (err) { + opkg_msg(ERROR, "Failed to stat %s: %s\n", + local_filename, strerror(errno)); + return -1; + } + + if (pkg_stat.st_size != pkg_get_int(pkg, PKG_SIZE)) { + if (!conf->force_checksum) { + opkg_msg(ERROR, + "Package size mismatch: %s is %lld bytes, expecting %lld bytes\n", + pkg->name, (long long int)pkg_stat.st_size, + (long long int)pkg_get_int(pkg, PKG_SIZE)); + return -1; + } else { + opkg_msg(NOTICE, + "Ignored %s size mismatch.\n", + pkg->name); + } + } + /* Check for md5 values */ pkg_md5 = pkg_get_md5(pkg); if (pkg_md5) { |