[PATCH 0/2] deb: fix heap-buffer-overflow read on a malformed .deb control member

From: root <[email protected]>

debDebPkgFileIndex::GetContent() reads past the extracted control buffer when a
.deb has an empty control member; apt-cache show, apt-get install ./x.deb and
apt-get download parse that member with apt's own ar/tar extractor. Same class
as the recent tagfile Fill() underflow (f5514f9) and the srvrec fix. Details are
in patch 1; patch 2 is an integration regression test.

Verified with an ASan build (a crafted zero-length ./control member) plus the
deb/control integration and libapt unit tests, with no new failures.

I do not have a Salsa account yet (registration is pending manual review), so I
am sending this to the list; happy to open a merge request instead once the
account is approved.

Nexory (2):
  deb: guard the empty control member case in GetContent
  test: add regression test for an empty .deb control member

 apt-pkg/deb/debindexfile.cc                   |  6 ++++
 .../test-github-empty-deb-control-oob         | 28 +++++++++++++++++++
 2 files changed, 34 insertions(+)
 create mode 100755 test/integration/test-github-empty-deb-control-oob


base-commit: 5e6dcc8d0c8bdce61e9cc7f497abadb5349d509a
-- 
2.53.0