{"record":{"id":"f4d7a7502cd26802","repo":"can1357/oh-my-pi","slug":"invalid-rpm-package-string-tag-tag-exceeds-hea","errorCode":null,"errorMessage":"Invalid RPM package: string tag ${tag} exceeds header data","messagePattern":"Invalid RPM package: string tag (.+?) exceeds header data","errorType":"exception","errorClass":"ArchiveError","httpStatus":null,"severity":"error","filePath":"packages/utils/src/ar/rpm.ts","lineNumber":97,"sourceCode":"\t\tconst offset = readUInt32BE(body, recordOffset + 8);\n\t\tconst count = readUInt32BE(body, recordOffset + 12);\n\t\tif (offset > intro.dataSize) throw new ArchiveError(`Invalid RPM package: tag ${tag} points outside header data`);\n\t\tconst remaining = intro.dataSize - offset;\n\t\tlet elementSize = 0;\n\t\tif (type === 1 || type === 2 || type === 7) elementSize = 1;\n\t\telse if (type === 3) elementSize = 2;\n\t\telse if (type === 4) elementSize = 4;\n\t\telse if (type === 5) elementSize = 8;\n\t\telse if (type === 0) {\n\t\t\tif (count !== 0) throw new ArchiveError(`Invalid RPM package: null tag ${tag} has values`);\n\t\t\tcontinue;\n\t\t} else if (type === RPM_TYPE_STRING || type === 8 || type === 9) {\n\t\t\tconst stringCount = type === RPM_TYPE_STRING ? 1 : count;\n\t\t\tif (type === RPM_TYPE_STRING && count !== 1) {\n\t\t\t\tthrow new ArchiveError(`Invalid RPM package: string tag ${tag} has an invalid count`);\n\t\t\t}\n\t\t\tif (stringCount > remaining) {\n\t\t\t\tthrow new ArchiveError(`Invalid RPM package: string tag ${tag} exceeds header data`);\n\t\t\t}\n\t\t\tlet cursor = indexSize + offset;\n\t\t\tconst limit = indexSize + intro.dataSize;\n\t\t\tfor (let stringIndex = 0; stringIndex < stringCount; stringIndex++) {\n\t\t\t\twhile (cursor < limit && body[cursor] !== 0) cursor++;\n\t\t\t\tif (cursor === limit) {\n\t\t\t\t\tthrow new ArchiveError(`Invalid RPM package: string tag ${tag} is not NUL-terminated`);\n\t\t\t\t}\n\t\t\t\tcursor++;\n\t\t\t}\n\t\t\tcontinue;\n\t\t} else {\n\t\t\tthrow new ArchiveError(`Invalid RPM package: tag ${tag} uses unknown data type ${type}`);\n\t\t}\n\t\tif (offset % elementSize !== 0) throw new ArchiveError(`Invalid RPM package: tag ${tag} data is misaligned`);\n\t\tif (count * elementSize > remaining)\n\t\t\tthrow new ArchiveError(`Invalid RPM package: tag ${tag} exceeds header data`);\n\t}","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/utils/src/ar/rpm.ts#L79-L115","documentation":"For string-family tags (STRING=6, string array=8, I18N string=9), the parser checks that the declared number of strings can physically fit between the tag's data offset and the end of the header data region. If stringCount > remaining bytes, the index entry points at more data than the header actually contains, so the header is inconsistent and parsing stops.","triggerScenarios":"readRpm()/parseMainHeader validates a header whose index entry declares a string (or string-array) tag with an offset near the end of the data region and a count that overruns dataSize (e.g. offset = dataSize - 1 with a 3-element string array).","commonSituations":"Truncated or corrupted .rpm downloads; bit-flipped count/offset fields in the header; maliciously crafted packages designed to cause out-of-bounds reads (this check prevents that); archives misrouted into the RPM reader.","solutions":["Re-acquire the .rpm file; the header is internally inconsistent, so it cannot be parsed.","Cross-check with `rpm -qp` to confirm corruption.","Ensure the upstream source serving the file is not truncating it (proxy, partial upload).","Wrap readRpm in try-catch on ArchiveError and surface a clear 'corrupt package' message to users."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Pre-check: file should at least contain lead (96) + header bytes; verify expected size from your source manifest before parsing\nif (fileSize < manifestExpectedSize) throw new Error(\"package truncated before parse\");","typeGuard":null,"tryCatchPattern":"try {\n  const entries = await readRpm(source, options);\n} catch (err) {\n  if (err instanceof ArchiveError && err.message.includes(\"exceeds header data\")) {\n    logger.warn(\"RPM header inconsistent\", { file });\n    return null;\n  }\n  throw err;\n}","preventionTips":["Verify file checksums/size against upstream manifests before parsing.","Detect truncated downloads (Content-Length mismatch) before feeding files to the parser.","Only parse RPMs from trusted repositories."],"tags":["rpm","archive","corrupt-file","bounds-check"],"backgroundTag":"rpm-header-validation-failed","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}