{"record":{"id":"364e1c6490bc0e79","repo":"can1357/oh-my-pi","slug":"invalid-rpm-package-tag-tag-string-is-too-larg","errorCode":null,"errorMessage":"Invalid RPM package: tag ${tag} string is too large","messagePattern":"Invalid RPM package: tag (.+?) string is too large","errorType":"validation","errorClass":"ArchiveError","httpStatus":null,"severity":"error","filePath":"packages/utils/src/ar/rpm.ts","lineNumber":135,"sourceCode":"\nfunction readHeaderString(\n\tbody: Uint8Array,\n\tindexSize: number,\n\tdataSize: number,\n\toffset: number,\n\tcount: number,\n\ttype: number,\n\ttag: number,\n): string {\n\tif (type !== RPM_TYPE_STRING || count !== 1) {\n\t\tthrow new ArchiveError(`Invalid RPM package: tag ${tag} must contain one string`);\n\t}\n\tconst start = indexSize + offset;\n\tconst limit = indexSize + dataSize;\n\tlet end = start;\n\twhile (end < limit && body[end] !== 0) end++;\n\tif (end === limit) throw new ArchiveError(`Invalid RPM package: tag ${tag} string is not NUL-terminated`);\n\tif (end - start > 4096) throw new ArchiveError(`Invalid RPM package: tag ${tag} string is too large`);\n\ttry {\n\t\treturn UTF8_FATAL_DECODER.decode(body.subarray(start, end));\n\t} catch {\n\t\tthrow new ArchiveError(`Invalid RPM package: tag ${tag} is not valid UTF-8`);\n\t}\n}\n\nfunction parseMainHeader(body: Uint8Array, intro: HeaderIntro): RpmMetadata {\n\tvalidateHeaderBody(body, intro, \"main\");\n\tconst indexSize = intro.indexCount * RPM_INDEX_ENTRY_SIZE;\n\tif (body.byteLength !== intro.bodySize) throw new ArchiveError(\"Invalid RPM package: truncated main header\");\n\tconst metadata: RpmMetadata = {};\n\tfor (let index = 0; index < intro.indexCount; index++) {\n\t\tconst recordOffset = index * RPM_INDEX_ENTRY_SIZE;\n\t\tconst tag = readUInt32BE(body, recordOffset);\n\t\tconst type = readUInt32BE(body, recordOffset + 4);\n\t\tconst offset = readUInt32BE(body, recordOffset + 8);\n\t\tconst count = readUInt32BE(body, recordOffset + 12);","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/utils/src/ar/rpm.ts#L117-L153","documentation":"As a defensive limit, single-string metadata tag values longer than 4096 bytes are rejected. Real NAME/VERSION/compressor strings are far shorter, so a value this large indicates corruption or an adversarial header; the parser stops instead of allocating/returning a huge string.","triggerScenarios":"parseMainHeader decodes one of the known string tags and the NUL-terminated byte run from the tag offset exceeds 4096 characters — e.g. a NAME field stuffed with kilobytes of data by a crafted package.","commonSituations":"Maliciously crafted packages with oversized metadata fields; corruption that destroys the NUL terminator so the scan runs long; tooling that writes pathological metadata values.","solutions":["Treat the package as invalid: obtain it from a trusted source and verify its checksum/signature.","Rebuild the package with sane metadata if it came from internal tooling.","Inspect the header tags with `rpm -qp` to see the offending oversized value.","Catch ArchiveError and quarantine the package rather than parsing it."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Verify package authenticity before parsing untrusted RPMs\nconst trusted = await verifyRpmSignature(filePath); // e.g. rpm --checksig equivalent\nif (!trusted) throw new Error(\"refusing to parse unverified RPM\");","typeGuard":null,"tryCatchPattern":"try {\n  return await readRpm(source, options);\n} catch (err) {\n  if (err instanceof ArchiveError && err.message.includes(\"string is too large\")) {\n    return quarantine(file, \"oversized RPM metadata (possible tampering)\");\n  }\n  throw err;\n}","preventionTips":["Only parse RPMs from signed, trusted repositories — oversized strings usually indicate tampering.","Verify GPG signatures/checksums before parsing third-party packages.","Quarantine files that trip defensive limits rather than attempting workarounds."],"tags":["rpm","archive","limits","untrusted-input"],"backgroundTag":"rpm-header-validation-failed","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}