Handle null pkgcache for local/sync db_populate()

In sync_db_populate() and local_db_populate(), a NULL db->pkgcache is not
caught, allowing the functions to continue instead of exiting.

A later alpm_list_msort() call which uses alpm_list_nth() will thus traverse
invalid pointers in a non-existent db->pkgcache->list.

pm_errno is set to PM_ERR_MEMORY as _alpm_pkghash_create() will only return
NULL when we run out of memory / exceed max hash table size. The local/sync
db_populate() functions are also exited.

Signed-off-by: Pang Yan Han <pangyanhan@gmail.com>
Signed-off-by: Dan McGee <dan@archlinux.org>

1 files changed, 7 insertions, 1 deletions

diff --git a/lib/libalpm/be_sync.c b/lib/libalpm/be_sync.c
index 4ad045c2..4e9b4d31 100644
--- a/lib/libalpm/be_sync.c
+++ b/lib/libalpm/be_sync.c
@@ -234,6 +234,9 @@ static int sync_db_populate(pmdb_t *db)
 
 	/* initialize hash at 66% full */
 	db->pkgcache = _alpm_pkghash_create(est_count * 3 / 2);
+	if(db->pkgcache == NULL) {
+		RET_ERR(PM_ERR_MEMORY, -1);
+	}
 
 	while(archive_read_next_header(archive, &entry) == ARCHIVE_OK) {
 		const struct stat *st;
@@ -348,6 +351,9 @@ static int sync_db_read(pmdb_t *db, struct archive *archive,
 	if(likely_pkg && strcmp(likely_pkg->name, pkgname) == 0) {
 		pkg = likely_pkg;
 	} else {
+		if(db->pkgcache == NULL) {
+			RET_ERR(PM_ERR_MEMORY, -1);
+		}
 		pkg = _alpm_pkghash_find(db->pkgcache, pkgname);
 	}
 	if(pkg == NULL) {
@@ -459,10 +465,10 @@ pmdb_t *_alpm_db_register_sync(const char *treename)
 	_alpm_log(PM_LOG_DEBUG, "registering sync database '%s'\n", treename);
 
 	db = _alpm_db_new(treename, 0);
-	db->ops = &sync_db_ops;
 	if(db == NULL) {
 		RET_ERR(PM_ERR_DB_CREATE, NULL);
 	}
+	db->ops = &sync_db_ops;
 
 	handle->dbs_sync = alpm_list_add(handle->dbs_sync, db);
 	return(db);