diff --git a/backport-Enforce-the-same-sanity-checks-on-db-add-and-rebuild.patch b/backport-Enforce-the-same-sanity-checks-on-db-add-and-rebuild.patch new file mode 100644 index 0000000000000000000000000000000000000000..b9dfbc7695e51b714dd6072aa95c9147e06f7711 --- /dev/null +++ b/backport-Enforce-the-same-sanity-checks-on-db-add-and-rebuild.patch @@ -0,0 +1,64 @@ +From 1fbf8aeb4e78b8b4afeeaafcbc97b3cbf7cfeaba Mon Sep 17 00:00:00 2001 +From: Panu Matilainen +Date: Tue, 17 Sep 2024 08:31:35 +0300 +Subject: [PATCH] Enforce the same sanity checks on db add and rebuild + +Conflict:adapt context; don't use RPMTAG_HEADERIMMUTABLE because +e484d99 is not merged; use int type instead of bool in validHeader() +Reference:https://github.com/rpm-software-management/rpm/commit/1fbf8aeb4e78b8b4afeeaafcbc97b3cbf7cfeaba + +It doesn't make a whole lot of sense to allow inserting headers +that will get removed as invalid on the next rebuild. Funny what +oddities have survived all this time... + +Fixes: #3306 +--- + lib/rpmdb.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/lib/rpmdb.c b/lib/rpmdb.c +index 3bf3457f3..dccdf80cd 100644 +--- a/lib/rpmdb.c ++++ b/lib/rpmdb.c +@@ -2176,6 +2176,17 @@ exit: + return (rc == 0) ? RPMRC_OK : RPMRC_FAIL; + } + ++static int validHeader(Header h) ++{ ++ if (!(headerIsEntry(h, RPMTAG_NAME) && ++ headerIsEntry(h, RPMTAG_VERSION) && ++ headerIsEntry(h, RPMTAG_RELEASE))) ++ { ++ return 0; ++ } ++ return 1; ++} ++ + int rpmdbAdd(rpmdb db, Header h) + { + dbiIndex dbi = NULL; +@@ -2189,7 +2200,7 @@ int rpmdbAdd(rpmdb db, Header h) + return 0; + + hdrBlob = headerExport(h, &hdrLen); +- if (hdrBlob == NULL || hdrLen == 0) { ++ if (!validHeader(h) || hdrBlob == NULL || hdrLen == 0) { + ret = -1; + goto exit; + } +@@ -2424,10 +2435,7 @@ int rpmdbRebuild(const char * prefix, rpmts ts, + while ((h = rpmdbNextIterator(mi)) != NULL) { + + /* let's sanity check this record a bit, otherwise just skip it */ +- if (!(headerIsEntry(h, RPMTAG_NAME) && +- headerIsEntry(h, RPMTAG_VERSION) && +- headerIsEntry(h, RPMTAG_RELEASE))) +- { ++ if (!validHeader(h)) { + rpmlog(RPMLOG_ERR, + _("header #%u in the database is bad -- skipping.\n"), + rpmdbGetIteratorOffset(mi)); +-- +2.33.0 + diff --git a/backport-Fix-a-memory-leak-on-rpmdb-importdb.patch b/backport-Fix-a-memory-leak-on-rpmdb-importdb.patch new file mode 100644 index 0000000000000000000000000000000000000000..cfb07c4bf37e09328a18e92fb2d6430aa23f69c8 --- /dev/null +++ b/backport-Fix-a-memory-leak-on-rpmdb-importdb.patch @@ -0,0 +1,27 @@ +From 4b830f7b5a4a70a53e2eef63baf82b7fff308a3c Mon Sep 17 00:00:00 2001 +From: Panu Matilainen +Date: Fri, 11 Oct 2024 14:26:57 +0300 +Subject: [PATCH] Fix a memory leak on rpmdb --importdb + +Conflict:modify rpmdb.c instead of tools/rpmdb.cc +Reference:https://github.com/rpm-software-management/rpm/commit/4b830f7b5a4a70a53e2eef63baf82b7fff308a3c + +--- + rpmdb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/rpmdb.c b/rpmdb.c +index 20d5d67bd..1736e1ef7 100644 +--- a/rpmdb.c ++++ b/rpmdb.c +@@ -79,6 +79,7 @@ static int importDB(rpmts ts) + Header h; + while ((h = headerRead(fd, HEADER_MAGIC_YES))) { + rc += rpmtsImportHeader(txn, h, 0); ++ headerFree(h); + } + } else { + rc = -1; +-- +2.33.0 + diff --git a/backport-Fix-memleak-when-process-policies.patch b/backport-Fix-memleak-when-process-policies.patch new file mode 100644 index 0000000000000000000000000000000000000000..a17506e0615e7026baee415dc562540ab1071689 --- /dev/null +++ b/backport-Fix-memleak-when-process-policies.patch @@ -0,0 +1,35 @@ +From 937e725626eecad2e0c34463e733ae123ba2ff5e Mon Sep 17 00:00:00 2001 +From: xujing +Date: Thu, 12 Sep 2024 20:52:30 +0800 +Subject: [PATCH] Fix memleak when process policies + +Conflict:NA +Reference:https://github.com/rpm-software-management/rpm/commit/937e725626eecad2e0c34463e733ae123ba2ff5e + +--- + build/policies.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/build/policies.c b/build/policies.c +index 5d704c0eb..69062ee6a 100644 +--- a/build/policies.c ++++ b/build/policies.c +@@ -289,6 +289,7 @@ static rpmRC processPolicies(rpmSpec spec, Package pkg, int test) + mod = freeModule(mod); + name = _free(name); + types = _free(types); ++ optCon = poptFreeContext(optCon); + } + + rc = RPMRC_OK; +@@ -297,6 +298,7 @@ static rpmRC processPolicies(rpmSpec spec, Package pkg, int test) + freeModule(mod); + free(name); + free(types); ++ poptFreeContext(optCon); + + return rc; + } +-- +2.33.0 + diff --git a/rpm.spec b/rpm.spec index 09cc3266e820452d58786e41b129e53bdbf0ec67..4c2141f4e15e39e1dbbffdd65ea25b56333586c9 100644 --- a/rpm.spec +++ b/rpm.spec @@ -1,6 +1,6 @@ Name: rpm Version: 4.18.2 -Release: 20 +Release: 21 Summary: RPM Package Manager License: GPL-2.0-or-later URL: https://rpm.org/ @@ -54,6 +54,9 @@ Patch6031: backport-Add-ECDSA-support-to-digest_openssl.patch Patch6032: backport-Support-NIST-P-521.patch Patch6033: backport-Allow-signing-with-ECDSA-keys.patch Patch6034: backport-Support-ECDSA-in-key-parsing.patch +Patch6035: backport-Fix-memleak-when-process-policies.patch +Patch6036: backport-Enforce-the-same-sanity-checks-on-db-add-and-rebuild.patch +Patch6037: backport-Fix-a-memory-leak-on-rpmdb-importdb.patch Patch9000: Add-digest-list-plugin.patch Patch9001: Add-IMA-digest-list-support.patch @@ -343,13 +346,16 @@ make clean %exclude %{_mandir}/man8/rpmspec.8* %changelog +* Tue Nov 26 2024 hugel - 4.18.2-21 +- sync patches from upstream + * Tue Oct 29 2024 xujing - 4.18.2-20 - Support sm2p256v1 of ECDSA and sm3 of hash * Sat Oct 26 2024 Funda Wang - 4.18.2-19 - fix RPM_LD_FLAGS not got exported -* Fri Oct 25 2024 hugel - 4.18.2-18 +* Fri Oct 25 2024 xuce - 4.18.2-18 - Separate the SELinux patch from the IMA digest list patch * Sun Sep 29 2024 hugel - 4.18.2-17 diff --git a/still-in-use-of-python-scripts-from-old-version.patch b/still-in-use-of-python-scripts-from-old-version.patch index 50fdb6f5e208ea8f451e3cb837ef40d918a1a491..cc22b13f564d2ce99098b3ed04a5a3ae95bd5bfc 100644 --- a/still-in-use-of-python-scripts-from-old-version.patch +++ b/still-in-use-of-python-scripts-from-old-version.patch @@ -117,7 +117,7 @@ index 0000000..d9c4832 +# +# Support this by assuming that below each /usr/lib/python$VERSION/, all +# .pyc/.pyo files are to be compiled for /usr/bin/python$VERSION. -+# ++# +# For example, below /usr/lib/python2.6/, we're targeting /usr/bin/python2.6 +# and below /usr/lib/python3.1/, we're targeting /usr/bin/python3.1 +