libdpkg, Dpkg::Version: Reject empty upstream versions

These are not permitted by deb-version(5), but the code was letting
those through.

debian/changelog

@@ -3,6 +3,8 @@ dpkg (1.18.16) UNRELEASED; urgency=medium
   [ Guillem Jover ]
   * Add support for specifying multiple targets on «dpkg-buildpackage -T»
     which will be run successively. Closes: #671074
+  * Reject empty upstream versions in C and perl code. These are not permitted
+    by deb-version(5), but the code was letting those through.
   * Perl modules:
     - Whitelist DPKG_GENSYMBOLS_CHECK_LEVEL, DPKG_ROOT, DPKG_ADMINDIR and
       DPKG_DATADIR environment variables in Dpkg::Build::Info.

lib/dpkg/parsehelp.c

@@ -235,6 +235,8 @@ parseversion(struct dpkg_version *rversion, const char *string,
 
   /* XXX: Would be faster to use something like cisversion and cisrevision. */
   ptr = rversion->version;
+  if (!*ptr)
+    return dpkg_put_error(err, _("version number is empty"));
   if (*ptr && !c_isdigit(*ptr++))
     return dpkg_put_warn(err, _("version number does not start with digit"));
   for (; *ptr; ptr++) {

lib/dpkg/t/t-version.c

@@ -257,6 +257,12 @@ test_version_parse(void)
 	test_fail(parseversion(&a, "A:0-0", &err) == 0);
 	test_error(err);
 
+	/* Test invalid empty upstream version. */
+	test_fail(parseversion(&a, "-0", &err) == 0);
+	test_error(err);
+	test_fail(parseversion(&a, "0:-0", &err) == 0);
+	test_error(err);
+
 	/* Test upstream version not starting with a digit */
 	test_fail(parseversion(&a, "0:abc3-0", &err) == 0);
 	test_warn(err);
@@ -287,7 +293,7 @@ test_version_parse(void)
 
 TEST_ENTRY(test)
 {
-	test_plan(190);
+	test_plan(194);
 
 	test_version_blank();
 	test_version_is_informative();

scripts/Dpkg/Version.pm

@@ -416,6 +416,11 @@ sub version_check($) {
         return (0, $msg) if wantarray;
         return 0;
     }
+    if (not defined $version->version() or not length $version->version()) {
+        my $msg = g_('upstream version cannot be empty');
+        return (0, $msg) if wantarray;
+        return 0;
+    }
     if ($version->version() =~ m/^[^\d]/) {
         my $msg = g_('version number does not start with digit');
         return (0, $msg) if wantarray;

scripts/t/Dpkg_Version.t

@@ -30,7 +30,7 @@ my @ops = ('<', '<<', 'lt',
 	   '>=', 'ge',
 	   '>', '>>', 'gt');
 
-plan tests => scalar(@tests) * (3 * scalar(@ops) + 4) + 18;
+plan tests => scalar(@tests) * (3 * scalar(@ops) + 4) + 24;
 
 sub dpkg_vercmp {
      my ($a, $cmp, $b) = @_;
@@ -88,6 +88,14 @@ my $empty = Dpkg::Version->new('');
 ok($empty eq '', "Dpkg::Version->new('') eq ''");
 ok($empty->as_string() eq '', "Dpkg::Version->new('')->as_string() eq ''");
 ok(!$empty->is_valid(), 'empty version is invalid');
+$empty = Dpkg::Version->new('-0');
+ok($empty eq '', "Dpkg::Version->new('-0') eq '-0'");
+ok($empty->as_string() eq '-0', "Dpkg::Version->new('-0')->as_string() eq '-0'");
+ok(!$empty->is_valid(), 'empty upstream version is invalid');
+$empty = Dpkg::Version->new('0:-0');
+ok($empty eq '0:-0', "Dpkg::Version->new('0:-0') eq '0:-0'");
+ok($empty->as_string() eq '0:-0', "Dpkg::Version->new('0:-0')->as_string() eq '0:-0'");
+ok(!$empty->is_valid(), 'empty upstream version with epoch is invalid');
 my $ver = Dpkg::Version->new('10a:5.2');
 ok(!$ver->is_valid(), 'bad epoch is invalid');
 ok(!$ver, 'bool eval of invalid leads to false');
@@ -187,4 +195,3 @@ __DATA__
 1:3.8.1-1 3.8.GA-1 1
 1.0.1+gpl-1 1.0.1-2 1
 1a 1000a -1
--0.6.5 0.9.1 -1