RPM Package Manager, CVS Repository
  http://rpm5.org/cvs/
  ____________________________________________________________________________

  Server: rpm5.org                         Name:   Per Øyvind Karlsen
  Root:   /v/rpm/cvs                       Email:  pkarlsen@rpm5.org
  Module: rpm                              Date:   09-Dec-2007 18:31:24
  Branch: rpm-4_5                          Handle: 2007120917312300

  Modified files:           (Branch: rpm-4_5)
    rpm/lib                 rpmds.c

  Log:
    do not crash when FILELINKTOS has more entries than DIRNAMES
    (http://qa.mandriva.com/show_bug.cgi?id=32102)

  Summary:
    Revision    Changes     Path
    2.55.2.6    +6  -3      rpm/lib/rpmds.c
  ____________________________________________________________________________

  patch -p0 <<'@@ .'
  Index: rpm/lib/rpmds.c
  ============================================================================
  $ cvs diff -u -r2.55.2.5 -r2.55.2.6 rpmds.c
  --- rpm/lib/rpmds.c	6 Oct 2007 13:05:51 -0000	2.55.2.5
  +++ rpm/lib/rpmds.c	9 Dec 2007 17:31:23 -0000	2.55.2.6
  @@ -297,6 +297,7 @@
        && N != NULL && Count > 0)
       {
   	int xx;
  +	int_32 CountEVR, CountF;
   
   	ds = xcalloc(1, sizeof(*ds));
   	ds->Type = Type;
  @@ -310,9 +311,9 @@
   	ds->nopromote = _rpmds_nopromote;
   
   	if (tagEVR > 0)
  -	    xx = hge(h, tagEVR, &ds->EVRt, &ds->EVR, NULL);
  +	    xx = hge(h, tagEVR, &ds->EVRt, &ds->EVR, &CountEVR);
   	if (tagF > 0)
  -	    xx = hge(h, tagF, &ds->Ft, &ds->Flags, NULL);
  +	    xx = hge(h, tagF, &ds->Ft, &ds->Flags, &CountF);
   /*@-boundsread@*/
   	if (!scareMem && ds->Flags != NULL)
   	    ds->Flags = memcpy(xmalloc(ds->Count * sizeof(*ds->Flags)),
  @@ -350,6 +351,8 @@
   	    }
   	} else
   	if (tagN == RPMTAG_FILELINKTOS) {
  +	    if (Count > CountF) Count = CountF;
  +
   	    /* XXX Construct the absolute path of the target symlink(s). */
   	    const char ** av = xcalloc(Count+1, sizeof(*av));
   	    int i;
  @@ -359,7 +362,7 @@
   		    av[i] = xstrdup("");
   		else if (*N[i] == '/')
   		    av[i] = xstrdup(N[i]);
  -		else if (ds->EVR && ds->Flags)
  +		else if (ds->EVR && ds->Flags && ds->Flags[i] >= 0 && ds->Flags[i] < CountEVR)
   /*@-nullderef@*/	/* XXX ds->Flags != NULL */
   		    av[i] = rpmGenPath(NULL, ds->EVR[ds->Flags[i]], N[i]);
   /*@=nullderef@*/
  @@ .