Skip to content

Fetch signature and database from the same URL

Demi Obenour requested to merge demi/pacman:demi-master-patch-73519 into master

Previously, the for loops on lines 1035 and 1037 would advance to the next element in the server list, even if downloading the URL succeeded. If there are no more servers in the list, s would be NULL, causing a NULL pointer dereference on line 1046. If there were servers left in the list, the signature would be downloaded from a wrong URL.

  1. Fetching of database signatures is enabled.
  2. There is only one enabled remote repository URL, or fetching from all but the last one fails and fetching from the last one succeeds.
  3. An XferCommand is used.

Qubes OS Arch templates satisfy all of these conditions and trigger the bug.

Merge request reports