diff --git a/backport-Fix-memory-leak-when-using-testsolv-to-execute-cases.patch b/backport-Fix-memory-leak-when-using-testsolv-to-execute-cases.patch new file mode 100644 index 0000000000000000000000000000000000000000..5ed68119642c27810c299aa27c39540700f7ed87 --- /dev/null +++ b/backport-Fix-memory-leak-when-using-testsolv-to-execute-cases.patch @@ -0,0 +1,30 @@ +From 9a361f5248557e032f15890aac54c0db53c52098 Mon Sep 17 00:00:00 2001 +From: banjiuqingshan <63209634+banjiuqingshan@users.noreply.github.com> +Date: Sun, 19 Jun 2022 01:43:51 +0800 +Subject: [PATCH] Fix memory leak when using testsolv to execute cases + +*resultp will only keep the pointer of the last cycle, which will lead to memory leakage. +This solves the first memory leak problem in issue #496 "==255147==error..." + +Conflict:NA +Reference:https://github.com/openSUSE/libsolv/commit/9a361f5248557e032f15890aac54c0db53c52098 + +--- + ext/testcase.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/ext/testcase.c b/ext/testcase.c +index 035cfdbd1..c529057a8 100644 +--- a/ext/testcase.c ++++ b/ext/testcase.c +@@ -2448,7 +2448,10 @@ testcase_read(Pool *pool, FILE *fp, const char *testcase, Queue *job, char **res + } + } + if (resultp) ++ { ++ solv_free(*resultp); + *resultp = result; ++ } + else + solv_free(result); + if (resultflagsp) diff --git a/backport-Fix-segfault-on-conflict-resolution-when-using-bindings.patch b/backport-Fix-segfault-on-conflict-resolution-when-using-bindings.patch new file mode 100644 index 0000000000000000000000000000000000000000..d0b9b4c809b3216b433c51267bd33fb18da6fc6b --- /dev/null +++ b/backport-Fix-segfault-on-conflict-resolution-when-using-bindings.patch @@ -0,0 +1,31 @@ +From 2b5e6c28be7dffe1a3b5e90a35c5ee425c08aeb0 Mon Sep 17 00:00:00 2001 +From: niner +Date: Tue, 8 Feb 2022 18:10:54 +0100 +Subject: [PATCH] Fix segfault on conflict resolution when using bindings + +Solutionelement objects were created with a wrong solutionid (i.e. the +solution element id was used for the solutionid field). This led to invalid +array indexes when trying to read the extraflags which then escalated +into a segfault. Fix by setting solutionid correctly in the Solutionelement +constructor. + +Conflict:NA +Reference:https://github.com/openSUSE/libsolv/commit/2b5e6c28be7dffe1a3b5e90a35c5ee425c08aeb0 + +--- + bindings/solv.i | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/bindings/solv.i b/bindings/solv.i +index 3a6bac468..1d35bf61b 100644 +--- a/bindings/solv.i ++++ b/bindings/solv.i +@@ -3411,7 +3411,7 @@ returnself(matchsolvable) + e = solv_calloc(1, sizeof(*e)); + e->solv = solv; + e->problemid = problemid; +- e->solutionid = id; ++ e->solutionid = solutionid; + e->id = id; + e->type = type; + e->p = p; diff --git a/backport-ensure-duplinvolvedmap_all-is-reset.patch b/backport-ensure-duplinvolvedmap_all-is-reset.patch new file mode 100644 index 0000000000000000000000000000000000000000..68b18386ae6ea4dee5945d5a821c7faa0050e730 --- /dev/null +++ b/backport-ensure-duplinvolvedmap_all-is-reset.patch @@ -0,0 +1,30 @@ +From dd6e977782816e330a8f60cf78ca3d12fead3b10 Mon Sep 17 00:00:00 2001 +From: Jon Turney +Date: Sun, 14 Aug 2022 18:45:20 +0100 +Subject: [PATCH] Ensure duplinvolvedmap_all is reset when a solver is reused + +Otherwise, if solver is used with a SOLVER_DISTUPGRADE job, then reused +without one, this will cause solver_addduprules() to be called, even +though needduprules is 0, which will crash trying to dereference +solv->dupmap, which is NULL because solver_createdupmaps() hasn't been +called. + +Conflict:NA +Reference:https://github.com/openSUSE/libsolv/commit/dd6e977782816e330a8f60cf78ca3d12fead3b10 + +--- + src/solver.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/solver.c b/src/solver.c +index 28341d6d3..e3779e232 100644 +--- a/src/solver.c ++++ b/src/solver.c +@@ -3533,6 +3533,7 @@ solver_solve(Solver *solv, Queue *job) + map_zerosize(&solv->bestupdatemap); + solv->fixmap_all = 0; + map_zerosize(&solv->fixmap); ++ solv->dupinvolvedmap_all = 0; + map_zerosize(&solv->dupmap); + map_zerosize(&solv->dupinvolvedmap); + solv->process_orphans = 0; diff --git a/libsolv.spec b/libsolv.spec index 73992a031a9445f3ae87cf0dcc3eb859d88e516f..8ef51d47c0d32fb03dd439c805d4b3d8c57de7fd 100644 --- a/libsolv.spec +++ b/libsolv.spec @@ -15,7 +15,7 @@ Name: libsolv Version: 0.7.14 -Release: 5 +Release: 6 Summary: Package dependency solver License: BSD URL: https://github.com/openSUSE/libsolv @@ -27,6 +27,9 @@ Patch2: Fix-memory-leaks.patch Patch3: Fix-segfault-in-resolve_jobrules.patch Patch4: Fix-Memory-leaks-in-SWIG-generated-code-for-Python.patch Patch5: use-memmove-for-overlapping-regions.patch +Patch6: backport-Fix-memory-leak-when-using-testsolv-to-execute-cases.patch +Patch7: backport-Fix-segfault-on-conflict-resolution-when-using-bindings.patch +Patch8: backport-ensure-duplinvolvedmap_all-is-reset.patch #fix CVE-2021-3200,CVE-2021-44568,CVE-2021-44569,CVE-2021-44571,CVE-2021-44573,CVE-2021-44574,CVE-2021-44575,CVE-2021-44576,CVE-2021-44577,CVE-2021-33938,CVE-2021-33929,CVE-2021-33928,CVE-2021-33930 @@ -198,6 +201,10 @@ Python 3 version. %{_mandir}/man3/%{name}*.3* %changelog +* Tue Oct 20 2022 hanhuihui - 0.7.14-6 +- SUG:NA +- DESC:fix memory leak, bindings error, crash error + * Thu Mar 03 2022 xingxing - 0.7.14-5 - Type:cves - CVE:CVE-2021-3200-CVE-2021-44568-CVE-2021-44569-CVE-2021-44571-CVE-2021-44573-CVE-2021-44574-CVE-2021-44575-CVE-2021-44576-CVE-2021-44577