!73 [sync] PR-71: Fix double free for SIGUSR1

From: @openeuler-sync-bot 
Reviewed-by: @HuaxinLuGitee 
Signed-off-by: @HuaxinLuGitee

aide.spec

@@ -1,12 +1,12 @@
 %bcond_without have_check
 
 Name:       aide
-Version:    0.18.5
+Version:    0.18.6
-Release:    1
+Release:    5
 Summary:    Advanced Intrusion Detection Environment
 License:    GPLv2+
-URL:        http://sourceforge.net/projects/aide
+URL:        https://sourceforge.net/projects/aide
-Source0:    http://github.com/aide/aide/releases/download/v%{version}/%{name}-%{version}.tar.gz
+Source0:    https://github.com/aide/aide/releases/download/v%{version}/%{name}-%{version}.tar.gz
 Source1:    aide.conf
 Source2:    aide.logrotate
 
@@ -21,6 +21,10 @@ BuildRequires:  check-devel
 Requires:  libgcrypt-sm3
 
 Patch0:    Add-sm3-algorithm-for-aide.patch 
+Patch1:    backport-Fix-condition-for-error-message-of-failing-to-open-g.patch
+Patch2:    backport-Fix-parsing-of-lowercase-group-names.patch
+Patch3:    backport-Fix-concurrent-reading-of-extended-attributes-xattrs.patch
+Patch4:    backport-Handle-SIGUSR1-only-after-config-parsing.patch
 
 %description
 AIDE (Advanced Intrusion Detection Environment, [eyd]) is a file and directory integrity checker.
@@ -73,6 +77,36 @@ make check
 %{_mandir}/*/*
 
 %changelog
+* Wed Apr 16 2025 yixiangzhike <yixiangzhike007@163.com> - 0.18.6-5
+- Type: bugfix
+- ID: NA
+- SUG: NA
+- DESC: backport upstream patch to fix double free for SIGUSR1
+
+* Tue Mar 25 2025 yixiangzhike <yixiangzhike007@163.com> - 0.18.6-4
+- Type: bugfix
+- ID: NA
+- SUG: NA
+- DESC: backport upstream patch to fix concurrent reading of extended attributes
+
+* Wed Sep 4 2024 yixiangzhike <yixiangzhike007@163.com> - 0.18.6-3
+- Type: bugfix
+- ID: NA
+- SUG: NA
+- DESC: backport upstream patch to fix parsing of lowercase group names
+
+* Thu Jul 4 2024 yixiangzhike <yixiangzhike007@163.com> - 0.18.6-2
+- Type: bugfix
+- ID: NA
+- SUG: NA
+- DESC: backport upstream patch to fix error condition checking
+
+* Fri Dec 15 2023 Paul Thomas <paulthomas100199@gmail.com> - 0.18.6-1
+- Type: enhancement
+- ID: NA
+- SUG: NA
+- DESC: update to version 0.18.6
+
 * Wed Jul 12 2023 yixiangzhike <yixiangzhike007@163.com> - 0.18.5-1
 - Type:enhancement
 - ID:NA

backport-Fix-concurrent-reading-of-extended-attributes-xattrs.patch

@@ -0,0 +1,57 @@
+From 93831c717eaaa19d58da12ebeb28607cc6d43116 Mon Sep 17 00:00:00 2001
+From: Hannes von Haugwitz <hannes@vonhaugwitz.com>
+Date: Wed, 8 May 2024 23:20:41 +0200
+Subject: [PATCH] Fix concurrent reading of extended attributes (xattrs)
+
+---
+ src/do_md.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/src/do_md.c b/src/do_md.c
+index 20e62f9..4ff2a86 100644
+--- a/src/do_md.c
++++ b/src/do_md.c
+@@ -482,14 +482,13 @@ static void xattr_add(xattrs_type *xattrs, const char *key, const char
+ void xattrs2line(db_line *line) {
+     /* get all generic user xattrs. */
+     xattrs_type *xattrs = NULL;
+-    static ssize_t xsz = 1024;
+-    static char *xatrs = NULL;
+     ssize_t xret = -1;
+ 
+     if (!(ATTR(attr_xattrs)&line->attr))
+         return;
+ 
+-    if (!xatrs) xatrs = checked_malloc(xsz);
++    ssize_t xsz = 1024;
++    char *xatrs = xatrs = checked_malloc(xsz);
+ 
+     while (((xret = llistxattr(line->fullpath, xatrs, xsz)) == -1) && (errno == ERANGE)) {
+         xsz <<= 1;
+@@ -502,10 +501,8 @@ void xattrs2line(db_line *line) {
+         log_msg(LOG_LEVEL_WARNING, "listxattrs failed for %s:%s", line->fullpath, strerror(errno));
+     } else if (xret) {
+         const char *attr = xatrs;
+-        static ssize_t asz = 1024;
+-        static char *val = NULL;
+-
+-        if (!val) val = checked_malloc(asz);
++        ssize_t asz = 1024;
++        char *val = checked_malloc(asz);
+ 
+         xattrs = xattr_new();
+ 
+@@ -533,8 +530,9 @@ next_attr:
+             attr += len + 1;
+             xret -= len + 1;
+         }
++        free(val);
+     }
+-
++    free(xatrs);
+     line->xattrs = xattrs;
+ }
+ #endif
+-- 
+2.33.0
+

backport-Fix-condition-for-error-message-of-failing-to-open-g.patch

@@ -0,0 +1,27 @@
+From 87bd10564bb2497d9e6f03f12f4dd246fbcb1443 Mon Sep 17 00:00:00 2001
+From: Mingjie Shen <shen497@purdue.edu>
+Date: Tue, 14 Nov 2023 16:00:05 -0500
+Subject: [PATCH] Fix condition for error message of failing to open gzipped
+ files
+
+gzfh should be checked, instead of fh.
+---
+ src/be.c  | 2 +-
+ 2 files changed, 1 insertions(+), 1 deletion(-)
+
+diff --git a/src/be.c b/src/be.c
+index 39592cd..9ddaa48 100644
+--- a/src/be.c
++++ b/src/be.c
+@@ -160,7 +160,7 @@ void* be_init(bool readonly, url_t* u, bool iszipped, bool append, int linenumbe
+ #ifdef WITH_ZLIB
+     if(iszipped && !readonly){
+       gzFile gzfh = gzdopen(a,"w");
+-      if(fh==NULL){
++      if(gzfh==NULL){
+ 	log_msg(LOG_LEVEL_ERROR,"couldn't reopen file descriptor %li",a);
+       }
+       return gzfh;
+-- 
+2.33.0
+

backport-Fix-parsing-of-lowercase-group-names.patch

@@ -0,0 +1,47 @@
+From 9ed0843765f0f97f6d3f989995a492da20b8c410 Mon Sep 17 00:00:00 2001
+From: Hannes von Haugwitz <hannes@vonhaugwitz.com>
+Date: Tue, 3 Sep 2024 19:41:19 +0200
+Subject: [PATCH] Fix parsing of lowercase group names
+
+* closes: #176
+---
+ ChangeLog      | 3 +++
+ src/conf_lex.l | 4 +---
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/ChangeLog b/ChangeLog
+index 3505168..df764e9 100644
+--- a/ChangeLog
++++ b/ChangeLog
+@@ -1,3 +1,6 @@
++2024-09-03 Hannes von Haugwitz <hannes@vonhaugwitz.com>
++	* Fix parsing of lowercase group names (closes: #176)
++
+ 2023-08-01 Hannes von Haugwitz <hannes@vonhaugwitz.com>
+	* Release aide 0.18.6
+
+diff --git a/src/conf_lex.l b/src/conf_lex.l
+index 4186101..0cf8c71 100644
+--- a/src/conf_lex.l
++++ b/src/conf_lex.l
+@@ -5,8 +5,6 @@ G	[a-zA-Z0-9]
+ V	[a-zA-Z_]+[a-zA-Z0-9_]*
+ E	[\ ]*"="[\ ]*
+ 
+-O	[a-z_]
+-
+ %{
+ 
+ #define YYDEBUG 1
+@@ -460,7 +458,7 @@ LOG_LEVEL lex_log_level = LOG_LEVEL_DEBUG;
+   return (CONFIGOPTION);
+ }
+ 
+-<CONFIG>({O})+ {
++<CONFIG>[a-z]+(_[a-z]+)+ {
+   log_msg(LOG_LEVEL_ERROR,"%s:%d: unknown config option: '%s' (line: '%s')", conf_filename, conf_linenumber, conftext, conf_linebuf);
+   exit(INVALID_CONFIGURELINE_ERROR);
+ }
+-- 
+2.33.0
+

backport-Handle-SIGUSR1-only-after-config-parsing.patch

@@ -0,0 +1,53 @@
+From 04b51aa49461a2e762a7d363cabcd73718023250 Mon Sep 17 00:00:00 2001
+From: Hannes von Haugwitz <hannes@vonhaugwitz.com>
+Date: Tue, 25 Mar 2025 19:19:37 +0100
+Subject: [PATCH] Handle SIGUSR1 only after config parsing
+
+* closes: #181
+---
+ src/aide.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/src/aide.c b/src/aide.c
+index ff41f96..ac76f77 100644
+--- a/src/aide.c
++++ b/src/aide.c
+@@ -98,14 +98,11 @@ static void usage(int exitvalue)
+ 
+ static void sig_handler(int);
+ 
+-static void init_sighandler()
++static void init_db_sighandler()
+ {
+-  log_msg(LOG_LEVEL_DEBUG, "initialize signal handler for SIGTERM, SIGUSR1 and SIGHUP");
++  log_msg(LOG_LEVEL_DEBUG, "initialize signal handler for SIGTERM and SIGHUP");
+   signal(SIGTERM,sig_handler);
+-  signal(SIGUSR1,sig_handler);
+   signal(SIGHUP,sig_handler);
+-
+-  return;
+ }
+ 
+ static void init_crypto_lib() {
+@@ -598,7 +595,7 @@ int main(int argc,char**argv)
+   textdomain(PACKAGE);
+ #endif
+   umask(0177);
+-  init_sighandler();
++  init_db_sighandler();
+   init_crypto_lib();
+ 
+   setdefaults_before_config();
+@@ -626,6 +623,9 @@ int main(int argc,char**argv)
+ 
+   setdefaults_after_config();
+ 
++  log_msg(LOG_LEVEL_DEBUG, "initialize signal handler for SIGUSR1");
++  signal(SIGUSR1,sig_handler);
++
+   log_msg(LOG_LEVEL_CONFIG, "report_urls:");
+   log_report_urls(LOG_LEVEL_CONFIG);
+ 
+-- 
+2.33.0
+