Bug 15598 - rpm: Since the fix for CVE-2014-9620, file will print a "warning" that it only processed 256 notes (pterjan)
Summary: rpm: Since the fix for CVE-2014-9620, file will print a "warning" that it onl...
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: 4
Hardware: i586 Linux
Priority: High major
Target Milestone: ---
Assignee: QA Team
QA Contact:
URL: http://svnweb.mageia.org/packages?vie...
Whiteboard: has_procedure advisory MGA4-32-OK MGA...
Keywords: PATCH, validated_update
Depends on:
Blocks:
 
Reported: 2015-03-31 09:22 CEST by Oden Eriksson
Modified: 2015-04-01 18:58 CEST (History)
3 users (show)

See Also:
Source RPM: rpm
CVE:
Status comment:


Attachments

Description Oden Eriksson 2015-03-31 09:22:29 CEST
This problem was fixed in cauldron with:

* Sat Feb 14 2015 pterjan <pterjan> 1:4.12.0.1-20.mga5
+ Revision: 814948
- Don't fail the build when file reports to many notes in an ELF

And fixed for mga4 with rpm-4.11.1-9.1.mga4.

Hit the bug when trying to build mariadb-5.5.42:

[...]
stat: cannot stat '/home/iurt/rpmbuild/BUILDROOT/mariadb-5.5.42-1.mga4.x86_64/usr/sbin/mysqld,': No such file or directory
stat: cannot stat 'too': No such file or directory
stat: cannot stat 'many': No such file or directory
stat: cannot stat 'notes': No such file or directory
stat: cannot stat '(256)': No such file or directory
[...]

https://bugs.mageia.org/show_bug.cgi?id=15592#c1

Reproducible: 

Steps to Reproduce:
Oden Eriksson 2015-03-31 09:22:49 CEST

Blocks: (none) => 15592

Oden Eriksson 2015-03-31 09:23:54 CEST

Priority: Normal => High
Blocks: 15592 => (none)

Thierry Vignaud 2015-03-31 13:18:40 CEST

Keywords: (none) => PATCH
URL: (none) => http://svnweb.mageia.org/packages?view=revision&revision=819447
CC: (none) => thierry.vignaud

Comment 1 Oden Eriksson 2015-03-31 15:09:58 CEST
So, it's a regression with http://advisories.mageia.org/MGASA-2015-0030.html

FYI. MBS2 is using file-5.22
Comment 2 David Walser 2015-03-31 15:10:20 CEST
Building certain packages (mariadb in mga4 SVN, java-1.8.0-openjdk from Cauldron) fails until this rpm patch is installed.

We need to push this update before we can build the mariadb update for Bug 15592.

Advisory:
----------------------------------------

With the fix for CVE-2015-9620 in the file package (MGASA-2015-0030), when
building RPMs, sometimes the build will fail if the file command reports too
many ELF notes on one of the binaries in the RPM package being built. The rpm
package has been patched to work around these failures.

References:
http://advisories.mageia.org/MGASA-2015-0030.html
http://rpm.org/ticket/887
----------------------------------------

Updated packages in core/updates_testing:
----------------------------------------
rpm-4.11.1-9.1.mga4
librpmbuild3-4.11.1-9.1.mga4
librpmsign3-4.11.1-9.1.mga4
librpm3-4.11.1-9.1.mga4
librpm-devel-4.11.1-9.1.mga4
rpm-build-4.11.1-9.1.mga4
rpm-sign-4.11.1-9.1.mga4
python-rpm-4.11.1-9.1.mga4

from rpm-4.11.1-9.1.mga4.src.rpm

Assignee: bugsquad => qa-bugs
Summary: Since the fix for CVE-2014-9620, file will print a "warning" that it only processed 256 notes (pterjan) => rpm: Since the fix for CVE-2014-9620, file will print a "warning" that it only processed 256 notes (pterjan)

Comment 3 David Walser 2015-03-31 21:56:25 CEST
I checked mariadb out from Mageia 4 SVN (mgarepo co -d 4 mariadb) and built it locally with the updated rpm packages installed and it built fine on Mageia 4 i586.

Note that building mariadb requires over 4GB of free disk space.

Whiteboard: (none) => has_procedure MGA4-32-OK

Comment 4 David GEIGER 2015-03-31 23:18:03 CEST
Tested mga4_64,

Testing complete for rpm-4.11.1-9.1.mga4, Ok for me no regression found and seems to work properly.

Also I did do same successful test as David on comment 3.


$ bm -l mariadb.spec
+ umask 022
+ cd /home/david/mgarepo/mariadb/BUILD
+ cd mariadb-5.5.42
+ /usr/bin/rm -rf /home/david/mgarepo/mariadb/BUILDROOT/mariadb-5.5.42-1.mga4.x86_64
+ exit 0
succeeded!

CC: (none) => geiger.david68210
Whiteboard: has_procedure MGA4-32-OK => has_procedure MGA4-32-OK MGA4-64-OK

Comment 5 claire robinson 2015-04-01 18:36:40 CEST
Validating. Advisory uploaded.

Please push to 4 updates

Thanks

Keywords: (none) => validated_update
Whiteboard: has_procedure MGA4-32-OK MGA4-64-OK => has_procedure advisory MGA4-32-OK MGA4-64-OK
CC: (none) => sysadmin-bugs

Comment 6 Mageia Robot 2015-04-01 18:58:06 CEST
An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGAA-2015-0032.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.