https://bugzilla.suse.com/show_bug.cgi?id=1179416 https://bugzilla.suse.com/show_bug.cgi?id=1179416#c1 --- Comment #1 from Michael Schr�der --- Hmm, but what has changed? -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1179416 https://bugzilla.suse.com/show_bug.cgi?id=1179416#c4 --- Comment #4 from Michael Schr�der --- Ok, I think I know what's happening. I'll submit a fixed version into Factory. If that helps we'll backport the patch for SLE15. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1179416 https://bugzilla.suse.com/show_bug.cgi?id=1179416#c7 --- Comment #7 from Fabian Vogt --- (In reply to Dominique Leuenberger from comment #6)

(In reply to Michael Schr�der from comment #5)

...

Hmm, or maybe it's something else. The fix makes things better, so I'll submit anyway...

https://openqa.opensuse.org/tests/1540523 - seems not to have made a change for the openQA test. rpm still segfaults (interestingly enough, always on the same package)

This one is actually reproducible, it still breaks on retries. Core was generated by `rpm --root /mnt --dbpath /var/lib/rpm -U --percent --noglob --force --nodeps --'. Program terminated with signal SIGSEGV, Segmentation fault. #0 fpHashFunction (fp=0x55a7edf80d00) at fprint.c:274 274 hash ^= ((unsigned)fp->entry->dev); Missing separate debuginfos, use: zypper install glibc-debuginfo-2.32-3.1.x86_64 libacl1-debuginfo-2.2.53-4.1.x86_64 libbz2-1-debuginfo-1.0.8-2.20.x86_64 libcap2-debuginfo-2.43-1.1.x86_64 libgcrypt20-debuginfo-1.8.7-1.1.x86_64 libgpg-error0-debuginfo-1.39-1.1.x86_64 liblua5_3-5-debuginfo-5.3.6-1.1.x86_64 liblzma5-debuginfo-5.2.5-1.16.x86_64 libpcre1-debuginfo-8.44-1.19.x86_64 libpopt0-debuginfo-1.18-2.1.x86_64 libselinux1-debuginfo-3.1-2.1.x86_64 libz1-debuginfo-1.2.11-18.1.x86_64 libzstd1-debuginfo-1.4.5-2.4.x86_64 (gdb) bt #0 fpHashFunction (fp=0x55a7edf80d00) at fprint.c:274 #1 0x00007fd0bf6416ee in rpmFpHashGetEntry (tableKey=0x0, dataCount=<synthetic pointer>, data=<synthetic pointer>, key=<optimized out>, ht=0x55a7edfc5660) at ../lib/rpmhash.C:253 #2 fpCacheGetByFp (cache=0x55a7edf9d8a0, cache=0x55a7edf9d8a0, numRecs=<synthetic pointer>, recs=<synthetic pointer>, ix=<optimized out>, fp=<optimized out>) at fprint.c:449 #3 checkInstalledFiles (fpc=0x55a7edf9d8a0, fileCount=<optimized out>, ts=0x55a7edf7f8b0) at transaction.c:1160 #4 rpmtsPrepare (ts=<optimized out>) at transaction.c:1554 #5 rpmtsRun (ts=<optimized out>, okProbs=<optimized out>, ignoreSet=<optimized out>) at transaction.c:1815 #6 0x00007fd0bf637ae9 in rpmcliTransaction (ts=ts@entry=0x55a7edf7f8b0, ia=ia@entry=0x55a7ec060340 <rpmIArgs>, numPackages=1) at rpminstall.c:291 #7 0x00007fd0bf638e7e in rpmInstall (ts=ts@entry=0x55a7edf7f8b0, ia=<optimized out>, fileArgv=<optimized out>) at rpminstall.c:632 #8 0x000055a7ec05d961 in main (argc=12, argv=<optimized out>) at rpm.c:265 (gdb) p fp->entry $40 = (const struct fprintCacheEntry_s *) 0x0 -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1179416 https://bugzilla.suse.com/show_bug.cgi?id=1179416#c9 --- Comment #9 from Fabian Vogt --- I fail to reproduce the problem by upgrading breeze5-wallpapers with the original (BDB) rpm database from the upgrade system, but it fails with the converted NDB database reproducibly. valgrind reports this: ==769== Invalid read of size 8 ==769== at 0x485E730: fpHashFunction (fprint.c:274) ==769== by 0x48906ED: UnknownInlinedFun (rpmhash.C:259) ==769== by 0x48906ED: UnknownInlinedFun (fprint.c:449) ==769== by 0x48906ED: UnknownInlinedFun (transaction.c:1160) ==769== by 0x48906ED: UnknownInlinedFun (transaction.c:1554) ==769== by 0x48906ED: rpmtsRun (transaction.c:1815) ==769== by 0x4886AE8: rpmcliTransaction (rpminstall.c:291) ==769== by 0x4887E7D: rpmInstall (rpminstall.c:632) ==769== by 0x10A960: main (rpm.c:265) ==769== Address 0x5267b00 is 23 bytes after a block of size 25 free'd ==769== at 0x483A9AB: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==769== by 0x48A27BB: doLookupId.isra.0 (fprint.c:228) ==769== by 0x486A8B3: UnknownInlinedFun (fprint.c:346) ==769== by 0x486A8B3: UnknownInlinedFun (rpmfi.c:1804) ==769== by 0x486A8B3: UnknownInlinedFun (rpmfi.c:1797) ==769== by 0x486A8B3: fpCachePopulate (fprint.c:480) ==769== by 0x4890182: UnknownInlinedFun (transaction.c:1552) ==769== by 0x4890182: rpmtsRun (transaction.c:1815) ==769== by 0x4886AE8: rpmcliTransaction (rpminstall.c:291) ==769== by 0x4887E7D: rpmInstall (rpminstall.c:632) ==769== by 0x10A960: main (rpm.c:265) ==769== Block was alloc'd at ==769== at 0x483BD7B: realloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==769== by 0x48D3764: rrealloc (rpmmalloc.c:65) ==769== by 0x48E4805: rstrcat (rpmstring.c:116) ==769== by 0x48A2A4F: UnknownInlinedFun (fprint.c:142) ==769== by 0x48A2A4F: doLookupId.isra.0 (fprint.c:179) ==769== by 0x486A8B3: UnknownInlinedFun (fprint.c:346) ==769== by 0x486A8B3: UnknownInlinedFun (rpmfi.c:1804) ==769== by 0x486A8B3: UnknownInlinedFun (rpmfi.c:1797) ==769== by 0x486A8B3: fpCachePopulate (fprint.c:480) ==769== by 0x4890182: UnknownInlinedFun (transaction.c:1552) ==769== by 0x4890182: rpmtsRun (transaction.c:1815) ==769== by 0x4886AE8: rpmcliTransaction (rpminstall.c:291) ==769== by 0x4887E7D: rpmInstall (rpminstall.c:632) ==769== by 0x10A960: main (rpm.c:265) -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1179416 https://bugzilla.suse.com/show_bug.cgi?id=1179416#c11 --- Comment #11 from Dominique Leuenberger --- (In reply to Michael Schr�der from comment #10)

I fixed a bug that could cause access to freed memory two days ago, maybe that was the culprit.

In case you refer to: 5+- fix potential access of freed mem in ndb's glue code [bnc#1179416] 6+ * new patch: ndbglue.diff ==> that fails to build -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1179416 https://bugzilla.suse.com/show_bug.cgi?id=1179416#c13 --- Comment #13 from Fabian Vogt --- (In reply to Dominique Leuenberger from comment #11)

(In reply to Michael Schr�der from comment #10)

...

I fixed a bug that could cause access to freed memory two days ago, maybe that was the culprit.

In case you refer to: 5+- fix potential access of freed mem in ndb's glue code [bnc#1179416] 6+ * new patch: ndbglue.diff

==> that fails to build

Just tried: With rpm-4.16.0-15.1 from Base:System/rpm/openSUSE_Factory it still fails the same way. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1179416 https://bugzilla.suse.com/show_bug.cgi?id=1179416#c15 --- Comment #15 from Fabian Vogt --- Confirmed to work with Base:System/rpm-4.16.0-16.1: https://openqa.opensuse.org/tests/1578279 -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1179416 https://bugzilla.suse.com/show_bug.cgi?id=1179416#c18 --- Comment #18 from Swamp Workflow Management --- openSUSE-SU-2021:2682-1: An update that solves three vulnerabilities, contains two features and has one errata is now available. Category: security (important) Bug References: 1179416,1181805,1183543,1183545 CVE References: CVE-2021-20266,CVE-2021-20271,CVE-2021-3421 JIRA References: ECO-3622,SLE-17817 Sources used: openSUSE Leap 15.3 (src): python-rpm-4.14.3-37.2, rpm-4.14.3-37.2, rpm-ndb-4.14.3-37.2 -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1179416 https://bugzilla.suse.com/show_bug.cgi?id=1179416#c21 --- Comment #21 from Swamp Workflow Management --- openSUSE-SU-2021:1366-1: An update that solves three vulnerabilities and has 5 fixes is now available. Category: security (important) Bug References: 1179416,1183543,1183545,1183632,1183659,1185299,1187670,1188548 CVE References: CVE-2021-20266,CVE-2021-20271,CVE-2021-3421 JIRA References: Sources used: openSUSE Leap 15.2 (src): python-rpm-4.14.1-lp152.18.3.1, rpm-4.14.1-lp152.18.3.1 -- You are receiving this mail because: You are on the CC list for the bug.