pkgdb: recover from go-rpmdb panics on malformed rpm headers

Scanning an image whose rpm database carries a malformed header crashed
the whole run instead of failing the scan. go-rpmdb v0.1.1 imports a
header region as peList[1:ril] (entry.go:170) without checking ril >= 1,
so a header whose region trailer yields a zero index-length panics with
"slice bounds out of range [1:0]". rancher/rancher:v2.15.0 is one such
image; the panic propagated from ListPackages up through ospkg and killed
the process.

The parse path has been unguarded since the rpm backend first shipped,
and v0.1.1 is the latest go-rpmdb release, so there is no upstream fix to
pull in. Wrap ListPackages and InstalledFileNames in a recover that turns
a parser panic into an error. A database vexscan cannot parse is already
treated as a scan failure by pkgdb.Read, so this keeps that contract
rather than crashing.

The regression test builds a real SQLite rpm database holding the
smallest header that reaches the panicking slice and asserts Read returns
an error. Without the recover the same test reproduces the original
crash.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: cwayne18

internal/pkgdb/rpm.go

@@ -63,7 +63,7 @@ func (r *RPM) Read(fsys target.RootFS) ([]Package, error) {
 	}
 	defer handle.Close()
 
-	infos, err := handle.ListPackages()
+	infos, err := listPackages(handle)
 	if err != nil {
 		return nil, fmt.Errorf("%s: %w", db, err)
 	}
@@ -88,7 +88,7 @@ func (r *RPM) Read(fsys target.RootFS) ([]Package, error) {
 		// A package with no file list is normal (metapackages own nothing),
 		// but a header that fails to decode is not, and silently dropping its
 		// files would make the package look like docs-only.
-		files, err := info.InstalledFileNames()
+		files, err := installedFileNames(info)
 		if err != nil {
 			return nil, fmt.Errorf("%s: file list for %s: %w", db, info.Name, err)
 		}
@@ -105,3 +105,31 @@ func (r *RPM) Read(fsys target.RootFS) ([]Package, error) {
 // rpmEVR, sourceRPMName and normalizePaths live in rpmfile.go, which carries no
 // build tag: the file reader needs them too, and it has to keep working in the
 // norpm build that omits everything above.
+
+// listPackages wraps go-rpmdb's ListPackages so a parser panic becomes an
+// error. go-rpmdb v0.1.1 slices a header region as peList[1:ril] at
+// entry.go:170 without checking ril >= 1, so a header whose region index length
+// is zero -- as occurs in some rpm databases in the wild -- panics with "slice
+// bounds out of range [1:0]" rather than returning an error. A database we
+// cannot parse is a scan failure, not a crash of the whole run.
+func listPackages(handle *rpmdb.RpmDB) (infos []*rpmdb.PackageInfo, err error) {
+	defer func() {
+		if r := recover(); r != nil {
+			infos = nil
+			err = fmt.Errorf("go-rpmdb panicked parsing the database: %v", r)
+		}
+	}()
+	return handle.ListPackages()
+}
+
+// installedFileNames wraps InstalledFileNames for the same reason: it decodes
+// the package's header on demand and can panic on the same malformed input.
+func installedFileNames(info *rpmdb.PackageInfo) (names []string, err error) {
+	defer func() {
+		if r := recover(); r != nil {
+			names = nil
+			err = fmt.Errorf("go-rpmdb panicked reading the file list: %v", r)
+		}
+	}()
+	return info.InstalledFileNames()
+}

internal/pkgdb/rpm_panic_test.go

@@ -0,0 +1,87 @@
+//go:build !norpm
+
+package pkgdb
+
+import (
+	"database/sql"
+	"encoding/binary"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/cwayne18/vexscan/internal/target"
+)
+
+// panicHeader is an rpm header blob that drives go-rpmdb v0.1.1 into a panic
+// rather than an error. hdrblobImport slices the entry list as peList[1:ril]
+// (entry.go:170) without checking ril >= 1, so a header whose region trailer
+// yields a zero region index-length crashes with "slice bounds out of range
+// [1:0]". Databases in the wild carry such headers -- rancher/rancher:v2.15.0
+// is one -- and a database we cannot parse must be a scan error, not a crash of
+// the whole run.
+//
+// The bytes are the smallest header that reaches that line: one index entry
+// (il=1) that is a HEADERIMMUTABLE region tag with a non-zero offset, and an
+// all-zero region trailer so the computed ril is 0. Every field go-rpmdb
+// verifies before the slice -- the region tag type and count, the offset range,
+// the trailer bounds -- is satisfied; only the final slice is unreachable in a
+// well-formed header.
+func panicHeader() []byte {
+	be := func(v int32) []byte {
+		b := make([]byte, 4)
+		binary.BigEndian.PutUint32(b, uint32(v))
+		return b
+	}
+	var d []byte
+	d = append(d, be(1)...)  // il: one index entry
+	d = append(d, be(32)...) // dl: data length
+	// peList[0]: region tag RPMTAG_HEADERIMMUTABLE(63), RPM_BIN_TYPE(7),
+	// offset 16 (non-zero, so ril is not reset to il), count 16.
+	d = append(d, be(63)...)
+	d = append(d, be(7)...)
+	d = append(d, be(16)...)
+	d = append(d, be(16)...)
+	d = append(d, make([]byte, 16)...) // region data segment
+	d = append(d, make([]byte, 16)...) // region trailer, all zero -> ril == 0
+	return d
+}
+
+// writeSQLiteRPMDB builds a real SQLite rpm database at db within a throwaway
+// rootfs, holding blob as its single Packages row. It uses the modernc sqlite
+// driver that rpm.go blank-imports, so no new dependency is pulled in.
+func writeSQLiteRPMDB(t *testing.T, db string, blob []byte) target.RootFS {
+	t.Helper()
+	root := t.TempDir()
+	path := filepath.Join(root, filepath.FromSlash(strings.TrimPrefix(db, "/")))
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	conn, err := sql.Open("sqlite", path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+	if _, err := conn.Exec(`CREATE TABLE Packages (hnum INTEGER PRIMARY KEY, blob BLOB)`); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := conn.Exec(`INSERT INTO Packages (blob) VALUES (?)`, blob); err != nil {
+		t.Fatal(err)
+	}
+	return target.NewDirFS(root)
+}
+
+// TestRPMSurvivesAPanickingHeader is the regression guard: a header that makes
+// go-rpmdb panic must surface as an error from Read, so one malformed database
+// cannot take down the whole scan. Before the recover in listPackages this
+// call crashed the test binary outright.
+func TestRPMSurvivesAPanickingHeader(t *testing.T) {
+	fsys := writeSQLiteRPMDB(t, "/var/lib/rpm/rpmdb.sqlite", panicHeader())
+	pkgs, err := (&RPM{}).Read(fsys)
+	if err == nil {
+		t.Fatalf("a panicking rpm header parsed as an inventory: %+v", pkgs)
+	}
+	if !strings.Contains(err.Error(), "panicked") {
+		t.Errorf("error does not name the recovered panic: %v", err)
+	}
+}