Compare commits

..

No commits in common. "403dfa79baecc6964f0140064995346887e20078" and "bf207e5f05c66aebb7e94138a6b6e31a68d936d7" have entirely different histories.

4 changed files with 3 additions and 89 deletions

View File

@ -1,69 +0,0 @@
From 3c85711f35b987bd0ce17dd0fbaa0d9f2521c444 Mon Sep 17 00:00:00 2001
From: =?utf-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Thu, 11 Jul 2024 15:40:03 +0200
Subject: [PATCH] Fix a memory leak in select_next_target()
If a next target URL was found (non-NULL full_url) and then a transfer was
canceled or an off-line mode was requested, full_url string was not freed and a
memory leaked.
Discovered with Covscan:
16. librepo-1.18.0/librepo/downloader.c:891:13: alloc_fn: Storage is returned from allocation function "g_strdup_inline".
17. librepo-1.18.0/librepo/downloader.c:891:13: var_assign: Assigning: "full_url" = storage returned from "g_strdup_inline(target->target->path)".
22. librepo-1.18.0/librepo/downloader.c:919:9: noescape: Resource "full_url" is not freed or pointed-to in "lr_is_local_path".
24. librepo-1.18.0/librepo/downloader.c:924:13: noescape: Assuming resource "full_url" is not freed or pointed-to as ellipsis argument to "g_debug".
28. librepo-1.18.0/librepo/downloader.c:956:17: leaked_storage: Variable "full_url" going out of scope leaks the storage it points to.
# 954| "and no local URL is available",
# 955| target->target->path);
# 956|-> return FALSE;
# 957| }
# 958| }
16. librepo-1.18.0/librepo/downloader.c:891:13: alloc_fn: Storage is returned from allocation function "g_strdup_inline".
17. librepo-1.18.0/librepo/downloader.c:891:13: var_assign: Assigning: "full_url" = storage returned from "g_strdup_inline(target->target->path)".
22. librepo-1.18.0/librepo/downloader.c:919:9: noescape: Resource "full_url" is not freed or pointed-to in "lr_is_local_path".
24. librepo-1.18.0/librepo/downloader.c:924:13: noescape: Assuming resource "full_url" is not freed or pointed-to as ellipsis argument to "g_debug".
27. librepo-1.18.0/librepo/downloader.c:946:21: leaked_storage: Variable "full_url" going out of scope leaks the storage it points to.
# 944| g_set_error(err, LR_DOWNLOADER_ERROR, LRE_CBINTERRUPTED,
# 945| "Interrupted by LR_CB_ERROR from end callback");
# 946|-> return FALSE;
# 947| }
# 948| }
This patch fixes it.
The bug was introduced in 1.7.14 version
(08e4810fcdd753ce4728bd88b252f7b3d34b2cdb commit).
Reference:https://github.com/rpm-software-management/librepo/commit/3c85711f35b987bd0ce17dd0fbaa0d9f2521c444
Conflict:no
---
librepo/downloader.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/librepo/downloader.c b/librepo/downloader.c
index 364c0af..40dbeb2 100644
--- a/librepo/downloader.c
+++ b/librepo/downloader.c
@@ -943,6 +943,7 @@ select_next_target(LrDownload *dd,
"from end callback", __func__);
g_set_error(err, LR_DOWNLOADER_ERROR, LRE_CBINTERRUPTED,
"Interrupted by LR_CB_ERROR from end callback");
+ g_free(full_url);
return FALSE;
}
}
@@ -953,6 +954,7 @@ select_next_target(LrDownload *dd,
"Cannot download %s: Offline mode is specified "
"and no local URL is available",
target->target->path);
+ g_free(full_url);
return FALSE;
}
}
--
2.33.0

BIN
librepo-1.14.2.tar.gz Normal file

Binary file not shown.

Binary file not shown.

View File

@ -5,15 +5,13 @@
%bcond_with zchunk
Name: librepo
Version: 1.15.2
Release: 2
Version: 1.14.2
Release: 1
Summary: Repodata downloading library
License: LGPL-2.0-or-later
License: LGPLv2+
URL: https://github.com/rpm-software-management/librepo
Source0: %{url}/archive/%{version}/%{name}-%{version}.tar.gz
Patch1: backport-Fix-a-memory-leak-in-select_next_target.patch
BuildRequires: cmake check-devel doxygen pkgconfig(glib-2.0) gcc
BuildRequires: libcurl-devel >= %{libcurl_version} pkgconfig(libxml-2.0)
BuildRequires: pkgconfig(openssl) gpgme-devel libattr-devel pkgconfig(libcrypto)
@ -80,21 +78,6 @@ popd
%{python3_sitearch}/%{name}/
%changelog
* Mon Oct 21 2024 caixiaomeng <caixiaomeng2@huawei.com> - 1.15.2-2
- backport upstream commits, fix memory leak
* Thu Aug 3 2023 dillon chen <dillon.chen@gmail.com> - 1.15.2-1
- update to 1.15.2
* Thu Feb 02 2023 wangjunqi <wangjunqi@kylinos.cn> - 1.15.1-1
- update to 1.15.1
* Mon Oct 10 2022 dillon chen <dillon.chen@gmail.com> - 1.14.3-1
- update to 1.14.5
* Mon Jun 27 2022 dillon chen <dillon.chen@gmail.com> - 1.14.3-1
- update to 1.14.3
* Tue Nov 30 2021 fuanan <fuanan3@huawei.com> - 1.14.2-1
- update version to 1.14.2