mirror/openwrt
1
0
Fork 1
mirror of https://git.openwrt.org/openwrt/openwrt.git synced 2026-02-19 11:11:51 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

apk: handle edge case when parsing .apk files

Browse source 
This was a regression introduced in the recent alignment changes and led
to failures when reading (i.e. 'mkndx') certain packages like follows:

ERROR: python3-botocore-1.31.7-r1.apk: unexpected end of file

It affected packages with a header size greater than the read buffer
size of 128KB but less than 160KB (128KB + (128KB / 4)).

In those cases, we'd attempt a 0 byte read, leading to APKE_EOF.

Based on some tests of files across multiple archs and feeds, it seems
the only packages meeting those criteria were python3-botocore and
golang-github-jedisct1-dnscrypt-proxy2-dev.

Fixes: 64ec08eee1 ("apk: backport upstream fixes for unaligned access")
Signed-off-by: Matt Merhar <mattmerhar@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/21992
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 8c6ed4e927)
Link: https://github.com/openwrt/openwrt/pull/22001
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit is contained in:
Matt Merhar 2026-02-11 17:30:53 -05:00 • committed by Hauke Mehrtens
parent ac7c25ee92
commit 324e157b4b
2 changed files with 30 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
package/system/apk/Makefile
View file

@ -1,7 +1,7 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=apk
PKG_RELEASE:=4
PKG_RELEASE:=5
PKG_SOURCE_URL=https://gitlab.alpinelinux.org/alpine/apk-tools.git
PKG_SOURCE_PROTO:=git

29
package/system/apk/patches/0034-io-handle-edge-case-when-refilling-read-buffer.patch Normal file
View file

@ -0,0 +1,29 @@
From 1e985a4444d8c9ab5a0804b555858dcf518b243a Mon Sep 17 00:00:00 2001
From: Matt Merhar <mattmerhar@protonmail.com>
Date: Wed, 11 Feb 2026 16:04:52 -0500
Subject: [PATCH] io: handle edge case when refilling read buffer
This caused failures when processing specific (< 0.1%) .apk files in
the packages feed.
It affected packages with a header size greater than the read buffer
size of 128KB but less than 160KB (128KB + (128KB / 4)).
In those cases, we'd attempt a 0 byte read, leading to APKE_EOF.
---
src/io.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/src/io.c
+++ b/src/io.c
@@ -120,6 +120,10 @@ ssize_t apk_istream_read_max(struct apk_
continue;
}
+ if (is->ptr - is->buf >= APK_ISTREAM_ALIGN_SYNC) {
+ is->ptr = is->end = is->buf + ((is->ptr - is->buf) % APK_ISTREAM_ALIGN_SYNC);
+ }
+
r = is->ops->read(is, is->ptr, is->buf + is->buf_size - is->ptr);
if (r <= 0) break;