DomainKey-Signature: a=rsa-sha1; c=nofws; d=toastin.space; h=from
	:subject:to:message-id:date:mime-version:content-type
	:content-transfer-encoding; q=dns; s=ml; b=jvbabFRNstwymtQwYIdOz
	cNpDoUVw52iINCz0AhcUrkDvhp+kn/eTE0aNiZ9RMD2RiODyPmKKnSO7yP5lyI0D
	+5SalXtZVTOu9uVXRZRIFIAN46+EjKk7JZYAMucN0tDroKJClUJKyuaXinEPuArW
	ijjhT/cbVs1aR0VhHNcKffNz+ku6IYLaUgN4iTFPaKvfXaA58uG9EKZachpiV5MK
	xeMFuXjttkYjloZZplyJdm7ObIEabXFTcYgMfark/hgZjA4RnBRd1CDVA0dTSEK0
	rqPr5NnHYOzDaDYmk5u1EXMhOokB+itFTNXXJSYbMNsFyVewL0v7z8NfAYp2IMN/
	w==
From: Chloe Kudryavtsev <toast@toastin.space>
Subject: apk_blob_pull_dep corrupts virtpkg->version->ptr under clang
To: ~alpine/apk-tools@lists.alpinelinux.org
Message-ID: <5bbbc186-d3c5-beca-bfdb-f530a6c307e3@toastin.space>
Date: Wed, 10 Jul 2019 19:55:47 -0400
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.7.2
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit

Hi, virtual packages get their version corrupted under clang.
It specifically happens in add.c::171 (well, the invocation, digging 
deeper turned out to be difficult).

Steps to reproduce:
1. Launch a docker image - I used alpine:edge
2. Install the packages we'll need for the demonstration, full list at [1].
3. git clone https://git.alpinelinux.org/apk-tools
4. cd apk-tools
5. Apply the following patch: https://brpaste.xyz/raw/2B_m0A. Reasoning 
in [2]. (curl https://brpaste.xyz/raw/2B_m0A | patch -p1)
6. make CC=clang CFLAGS=-O2
7. ./src/apk -s add -t foo foo
8. Observe the discrepancies

NOTE: CFLAGS are -O2 because that makes the error easier to observe.
However it shows up even under -O0.

I have no familiarity with apk internals, but clang compiles many other 
things just fine without corrupting pointers at random.
Could someone look into this?

[1]: musl-dev linux-headers lua5.2-dev openssl-dev zlib-dev clang gcc 
make git curl
[2]: This adds two printf statements for easy viewing and removes -Wall 
(clang has stricter warnings, should be tackled, but maybe later).