[ppisar]

There was a copy-and-paste mistake in an inner loop in modulemd_module_stream_v2_emit_rpm_map() function. As a result when serializing a module index into a YAML string where a number of hash types was different from a number of hashes of a particular type in "rpm-map" modulemd-v2 YAML element, not all hashes would be serialized or an invalid memory would be read.

E.g. an attempt to serialize this document:

document: modulemd
version: 2
data:
  [...]
  artifacts:
    rpm-map:
      sha256:
        aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:
          name: bar
          epoch: 0
          version: 0
          release: 0
          arch: x86_64
          nevra: bar-0:0-0.x86_64
        bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb:
          name: foo
          epoch: 0
          version: 0
          release: 0
          arch: x86_64
          nevra: foo-0:0-0.x86_64
      sha512:
        bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb:
          name: bar
          epoch: 0
          version: 0
          release: 0
          arch: x86_64
          nevra: bar-0:0-0.x86_64

would provoke valgrind like this:

Use of uninitialised value of size 8
   at 0x48624E6: strlen (vg_replace_strmem.c:506)
   by 0x48D9027: mmd_emitter_scalar (modulemd-yaml-util.c:293)
   by 0x48C75DE: modulemd_module_stream_v2_emit_rpm_map (modulemd-module-stream-v2.c:3271)
   by 0x48C857A: modulemd_module_stream_v2_emit_yaml (modulemd-module-stream-v2.c:3211)
   by 0x48B1437: dump_streams (modulemd-module-index.c:498)
   by 0x48B1437: modulemd_module_index_dump_to_emitter (modulemd-module-index.c:562)
   by 0x48B169C: modulemd_module_index_dump_to_string (modulemd-module-index.c:936)
   by 0x401222: main (in /tmp/a.out)

This patch fixes an upper bound condition of the inner loop. It also adds a test.

This flaw was intruduced with b5abf3b commit ("Add rpm-map to ModuleStreamV2") and first released in 2.2.0 version.

Acknowledgement: Aisle Research
Resolves: CVE-2026-92824

[ppisar]

The failed rpm-build:epel-7 looks like a bug in Copr, I raised it at fedora-copr/copr#4596.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[ppisar]

I rebased to current main.