From 3bc213be498d015edc296a5d9221d3064979f540 Mon Sep 17 00:00:00 2001 From: maokecheng Date: Tue, 26 Dec 2023 17:26:04 +0800 Subject: [PATCH] * Tue Dec 26 2023 maokecheng - 1.10.2-6 -Reference:https://github.com/flatpak/flatpak/commit/b912053c6cc556f131465c1fd877d7bd0b433539 - DESC:Fix several memory leaks (cherry picked from commit 786a4cb6939cb8eb5b7bb5061c888430cd826428) --- backport-Fix-several-memory-leaks.patch | 85 +++++++++++++++++++++++++ flatpak.spec | 7 +- 2 files changed, 90 insertions(+), 2 deletions(-) create mode 100644 backport-Fix-several-memory-leaks.patch diff --git a/backport-Fix-several-memory-leaks.patch b/backport-Fix-several-memory-leaks.patch new file mode 100644 index 0000000..2c75b9c --- /dev/null +++ b/backport-Fix-several-memory-leaks.patch @@ -0,0 +1,85 @@ +From b912053c6cc556f131465c1fd877d7bd0b433539 Mon Sep 17 00:00:00 2001 +From: Phaedrus Leeds +Date: Sun, 2 May 2021 21:53:02 -0500 +Subject: [PATCH] Fix several memory leaks + +(cherry picked from commit 404d7c6941baf63d1b3ccbe9ee9d34f3ff12f35f) +--- + app/flatpak-builtins-document-export.c | 6 +++--- + common/flatpak-dir.c | 7 ++++--- + common/flatpak-utils.c | 1 + + portal/flatpak-portal.c | 2 +- + 4 files changed, 9 insertions(+), 7 deletions(-) + +diff --git a/app/flatpak-builtins-document-export.c b/app/flatpak-builtins-document-export.c +index 15f1ad1275..e701a826bb 100644 +--- a/app/flatpak-builtins-document-export.c ++++ b/app/flatpak-builtins-document-export.c +@@ -90,8 +90,8 @@ flatpak_builtin_document_export (int argc, char **argv, + g_autofree char *dirname = NULL; + g_autofree char *doc_path = NULL; + XdpDbusDocuments *documents; +- int fd, fd_id; +- int i; ++ glnx_autofd int fd = -1; ++ int i, fd_id; + GUnixFDList *fd_list = NULL; + const char *doc_id; + struct stat stbuf; +@@ -173,7 +173,7 @@ flatpak_builtin_document_export (int argc, char **argv, + + fd_list = g_unix_fd_list_new (); + fd_id = g_unix_fd_list_append (fd_list, fd, error); +- close (fd); ++ glnx_close_fd (&fd); + + if (opt_noexist) + { +diff --git a/common/flatpak-dir.c b/common/flatpak-dir.c +index 94a86f4afb..0724677b91 100644 +--- a/common/flatpak-dir.c ++++ b/common/flatpak-dir.c +@@ -13690,14 +13690,15 @@ parse_ref_file (GKeyFile *keyfile, + collection_id = g_key_file_get_string (keyfile, FLATPAK_REF_GROUP, + FLATPAK_REF_DEPLOY_COLLECTION_ID_KEY, NULL); + +- if (collection_id == NULL || *collection_id == '\0') ++ if (collection_id != NULL && *collection_id == '\0') ++ g_clear_pointer (&collection_id, g_free); ++ if (collection_id == NULL) + { + collection_id = g_key_file_get_string (keyfile, FLATPAK_REF_GROUP, + FLATPAK_REF_COLLECTION_ID_KEY, NULL); + } +- + if (collection_id != NULL && *collection_id == '\0') +- collection_id = NULL; ++ g_clear_pointer (&collection_id, g_free); + + if (collection_id != NULL && gpg_data == NULL) + return flatpak_fail_error (error, FLATPAK_ERROR_INVALID_DATA, _("Collection ID requires GPG key to be provided")); +diff --git a/common/flatpak-utils.c b/common/flatpak-utils.c +index 56cbb06db3..84bc6a398d 100644 +--- a/common/flatpak-utils.c ++++ b/common/flatpak-utils.c +@@ -2235,6 +2235,7 @@ flatpak_parse_repofile (const char *remote_name, + decoded = g_base64_decode (gpg_key, &decoded_len); + if (decoded_len < 10) /* Check some minimal size so we don't get crap */ + { ++ g_free (decoded); + flatpak_fail_error (error, FLATPAK_ERROR_INVALID_DATA, _("Invalid gpg key")); + return NULL; + } +diff --git a/portal/flatpak-portal.c b/portal/flatpak-portal.c +index 7887c57a3b..0539ff2d22 100644 +--- a/portal/flatpak-portal.c ++++ b/portal/flatpak-portal.c +@@ -767,7 +767,7 @@ handle_spawn (PortalFlatpak *object, + const gint *fds = NULL; + gint fds_len = 0; + g_autofree FdMapEntry *fd_map = NULL; +- gchar **env; ++ g_auto(GStrv) env = NULL; + gint32 max_fd; + GKeyFile *app_info; + g_autoptr(GPtrArray) flatpak_argv = g_ptr_array_new_with_free_func (g_free); diff --git a/flatpak.spec b/flatpak.spec index 580dcf6..6d3092b 100644 --- a/flatpak.spec +++ b/flatpak.spec @@ -1,6 +1,6 @@ Name: flatpak Version: 1.10.2 -Release: 5 +Release: 6 Summary: Application deployment framework for desktop apps License: LGPLv2+ URL: http://flatpak.org/ @@ -26,7 +26,7 @@ Patch6013: backport-0002-CVE-2021-43860.patch Patch6014: backport-0003-CVE-2021-43860.patch Patch6015: backport-0004-CVE-2021-43860.patch Patch6016: backport-0005-CVE-2021-43860.patch - +Patch6017: backport-Fix-several-memory-leaks.patch BuildRequires: pkgconfig(appstream-glib) pkgconfig(gio-unix-2.0) pkgconfig(gobject-introspection-1.0) >= 1.40.0 pkgconfig(json-glib-1.0) pkgconfig(libarchive) >= 2.8.0 BuildRequires: pkgconfig(libsoup-2.4) pkgconfig(libxml-2.0) >= 2.4 pkgconfig(ostree-1) >= 2020.8 pkgconfig(polkit-gobject-1) pkgconfig(libseccomp) pkgconfig(xau) BuildRequires: bison bubblewrap >= 0.4.0 docbook-dtds docbook-style-xsl gettext gpgme-devel libcap-devel systemd xmlto libxslt @@ -131,6 +131,9 @@ flatpak remote-list --system &> /dev/null || : %{_mandir}/man5/flatpak-remote.5* %changelog +* Tue Dec 26 2023 maokecheng - 1.10.2-6 +- DESC:Fix several memory leaks + * Mon Feb 07 2022 dongyuzhen - 1.10.2-5 - Fix CVE-2021-43860 -- Gitee