Bug 829993 – app-portage/cfg-update-1.8.9-r1: uninitialized value $md5sum_file

• Product: Gentoo Linux
• Status: UNCONFIRMED ---

[Description Phil Stracchino (Unix Ronin) 2021-12-26 05:26:11 UTC]

Short and sweet:

minbar:root:~:4 # cfg-update -l
Searching for updates...
Use of uninitialized value $md5sum_file in regexp compilation at /usr/bin/cfg-update line 1000.


$md5sum_file is declared at line 176.  It is not used until line 993 in sub determine_state(), where it is initialized ONLY IF $file1 is found.  If $file1 is not found or not a file, $md5sum_file will then be used uninitialized in lines 994 and 1000.

[Comment 1 Phil Stracchino (Unix Ronin) 2021-12-26 05:27:47 UTC]

(A simple fix would be to initialize $md5sum_file to an empty string when it is declared.)

[Comment 2 Phil Stracchino (Unix Ronin) 2022-06-25 20:49:21 UTC]

Still present in 1.8.9-r2

The fundamental problem here is that sub determine_state{} checks that $file1 exists before trying to calculate its md5sum, but then blindly goes on to use the uninitialized md5sum ANYWAY if it doesn't.

Try this one-line fix:

minbar:root:~:9 # diff -U5 /usr/bin/cfg-update /usr/bin/cfg-update.old
--- /usr/bin/cfg-update 2022-06-25 16:47:50.023193830 -0400
+++ /usr/bin/cfg-update.old     2022-04-23 13:12:25.109290952 -0400
@@ -995,11 +995,11 @@
         if ($opt_d >= 1) { print "$tab"."  grep \"$file1_without_host \" $host_path$index_file $debug | cut -d\" \" -f2 $debug\n"; }
         local $ENV{LC_ALL}="C";
         chomp ($md5sum_index = `grep "$file1_without_host " "$host_path$index_file" $debug | cut -d" " -f2 $debug`);
         if ($opt_d >= 1) { print "$tab"."  MD5 checksum in the checksum-index  : $md5sum_index\n"; }
         if ($md5sum_index =~ /.+/) {
-            if (length($md5sum_file) && $md5sum_index !~ $md5sum_file) {
+            if ($md5sum_index !~ $md5sum_file) {
                 $state = $state1; $vstate = $vstate1;                               #  1 = MF = Modified File     - checksum differs from index
                 if (-B "$file1") { $state = $state2; $vstate = $vstate2; }          #  2 = MB = Modified Binary   - you probably replaced the binary file so replace not allowed
             } else {
                 $state = $state3; $vstate = $vstate3;                               #  3 = UF = Unmodified File   - checksum matches with index
                 if (-B "$file1") { $state = $state4; $vstate = $vstate4; }          #  4 = UB = Unmodified Binary - unmodified binary file so replace always allowed

[Comment 3 Phil Stracchino (Unix Ronin) 2024-05-12 17:31:58 UTC]

(In reply to Phil Stracchino (Unix Ronin) from comment #2)
> Still present in 1.8.9-r2
> -            if (length($md5sum_file) && $md5sum_index !~ $md5sum_file) {
> +            if ($md5sum_index !~ $md5sum_file) {



To my significant embarrassment, NOT UNTIL TODAY when the issue resurfaced after a rebuild did I notice that my patch above is reversed.  Oops.

[Comment 4 Phil Stracchino (Unix Ronin) 2024-05-12 17:39:38 UTC]

Created attachment 892831 [details, diff]
CORRECTED patch for uninitialized $md5sum_file

Same patch, just it's the right way round this time.