Star0
11
Code
Code
Issues2
Pull Requests6
Discussion
Wiki
Analysis
Star0
11
Open
Fix CVE-2026-48863 #104
易大夫Add on 5 days ago
Fix CVE-2026-48863 #104
Open
易大夫Add on 5 days ago
Merged fromsun_jie001/libsolvcve-2026-48863-cp-2f08bb4-88intosrc-openeuler/libsolvmaster
Total: 9 files changed+260-2
AFix-Memory-leaks-in-SWIG-generated-code-for-Python.patch+31-0
@@ -0,0 +1,31 @@
1+From 8615575144e6fd3d708a30983ed2415db479ef4c Mon Sep 17 00:00:00 2001
2+From: Jaroslav Rohel <jrohel@redhat.com>
3+Date: Thu, 8 Apr 2021 12:17:09 +0200
4+Subject: [PATCH] Fix: Memory leaks in SWIG generated code (for Python)
5+ 
6+There were memory leaks in the `Chksum_from_bin`, `Chksum_add`,
7+`SolvFp_write` functions wrapper for Python.
8+ 
9+The problem was in "freearg" typemap argument defined in "solv.i".
10+Therefore, the typemap was not applied.
11+ 
12+Conflict: NA
13+Reference: https://github.com/openSUSE/libsolv/commit/8615575144e6fd3d708a30983ed2415db479ef4c
14+ 
15+---
16+ bindings/solv.i | 2 +-
17+ 1 file changed, 1 insertion(+), 1 deletion(-)
18+ 
19+diff --git a/bindings/solv.i b/bindings/solv.i
20+index 1882b135..3bbeca04 100644
21+--- a/bindings/solv.i
22++++ b/bindings/solv.i
23+@@ -63,7 +63,7 @@ typedef struct {
24+ $2 = size;
25+ }
26+
27+-%typemap(freearg,noblock=1,match="in") (const unsigned char *str, int len) {
28++%typemap(freearg,noblock=1,match="in") (const unsigned char *str, size_t len) {
29+ if (alloc$argnum == SWIG_NEWOBJ) %delete_array(buf$argnum);
30+ }
31+
AFix-memory-leaks.patch+42-0
@@ -0,0 +1,42 @@
1+From 71c6b26096086926f48d8fced1a03ca52a1eb745 Mon Sep 17 00:00:00 2001
2+From: Jaroslav Rohel <jrohel@redhat.com>
3+Date: Mon, 29 Mar 2021 12:46:31 +0200
4+Subject: [PATCH] Fix memory leaks
5+ 
6+Conflict: NA
7+Reference: https://github.com/openSUSE/libsolv/commit/71c6b26096086926f48d8fced1a03ca52a1eb745
8+ 
9+---
10+ ext/repo_deb.c | 1 +
11+ ext/testcase.c | 4 ++--
12+ 2 files changed, 3 insertions(+), 2 deletions(-)
13+ 
14+diff --git a/ext/repo_deb.c b/ext/repo_deb.c
15+index 8f637567..34f40fa8 100644
16+--- a/ext/repo_deb.c
17++++ b/ext/repo_deb.c
18+@@ -792,5 +792,6 @@ pool_deb_get_autoinstalled(Pool *pool, FILE *fp, Queue *q, int flags)
19+ break;
20+ }
21+ }
22++ solv_free(buf);
23+ }
24+
25+diff --git a/ext/testcase.c b/ext/testcase.c
26+index 8fb6d793..4e9e3154 100644
27+--- a/ext/testcase.c
28++++ b/ext/testcase.c
29+@@ -1477,11 +1477,11 @@ testcase_solverresult(Solver *solv, int resultflags)
30+ queue_init(&q);
31+ for (rid = 1; (rclass = solver_ruleclass(solv, rid)) != SOLVER_RULE_UNKNOWN; rid++)
32+ {
33+- char *prefix = solv_dupjoin("rule ", testcase_rclass2str(rclass), " ");
34+- prefix = solv_dupappend(prefix, testcase_ruleid(solv, rid), 0);
35+ solver_ruleliterals(solv, rid, &q);
36+ if (rclass == SOLVER_RULE_FEATURE && q.count == 1 && q.elements[0] == -SYSTEMSOLVABLE)
37+ continue;
38++ char *prefix = solv_dupjoin("rule ", testcase_rclass2str(rclass), " ");
39++ prefix = solv_dupappend(prefix, testcase_ruleid(solv, rid), 0);
40+ for (i = 0; i < q.count; i++)
41+ {
42+ Id p = q.elements[i];
AFix-segfault-in-resolve_jobrules.patch+28-0
@@ -0,0 +1,28 @@
1+From 0ecd4f310318d9bd91db48e5c9dc7e749fbed82a Mon Sep 17 00:00:00 2001
2+From: Thomas Lam <79589038+tl-hbk@users.noreply.github.com>
3+Date: Tue, 30 Mar 2021 05:33:52 -0700
4+Subject: [PATCH] Fix segfault in resolve_jobrules
5+ 
6+In selectandinstall sometimes rules are added and a realloc is required if there's
7+no more memory available in the allocated block. r-- would just decrement the old
8+pointer but the realloc could return a completely different block of memory
9+ 
10+Conflict: NA
11+Reference: https://github.com/openSUSE/libsolv/commit/0ecd4f310318d9bd91db48e5c9dc7e749fbed82a
12+ 
13+---
14+ src/solver.c | 1 +
15+ 1 file changed, 1 insertion(+)
16+ 
17+diff --git a/src/solver.c b/src/solver.c
18+index 9c02cc76..89a2ed10 100644
19+--- a/src/solver.c
20++++ b/src/solver.c
21+@@ -1629,6 +1629,7 @@ resolve_jobrules(Solver *solv, int level, int disablerules, Queue *dq)
22+ }
23+ olevel = level;
24+ level = selectandinstall(solv, level, dq, disablerules, i, SOLVER_REASON_RESOLVE_JOB);
25++ r = solv->rules + i; /* selectandinstall may have added more rules */
26+ if (level <= olevel)
27+ {
28+ if (level == olevel)
Abackport-CVE-2026-48863.patch+22-0
@@ -0,0 +1,22 @@
1+From 44f8c085045b1f771641091bbb2b810d12cff9e8 Mon Sep 17 00:00:00 2001
2+From: Michael Schroeder <mls@suse.de>
3+Date: Tue, 26 May 2026 10:30:31 +0200
4+Subject: [PATCH] Fix wrong variable being used in solv_pgpvrfy
5+ 
6+---
7+ ext/solv_pgpvrfy.c | 2 +-
8+ 1 file changed, 1 insertion(+), 1 deletion(-)
9+ 
10+diff --git a/ext/solv_pgpvrfy.c b/ext/solv_pgpvrfy.c
11+index 9f1bd72e6..9358558bc 100644
12+--- a/ext/solv_pgpvrfy.c
13++++ b/ext/solv_pgpvrfy.c
14+@@ -589,7 +589,7 @@ solv_pgpvrfy(const unsigned char *pub, int publ, const unsigned char *sig, int s
15+ if (rlen)
16+ memcpy(sigdata + 32 - rlen, r, rlen);
17+ if (slen)
18+- memcpy(sigdata + 64 - slen, s, rlen);
19++ memcpy(sigdata + 64 - slen, s, slen);
20+ res = mped25519(pub + 1 + 10 + 2 + 1, sigdata, sig + 2, hashl);
21+ break;
22+ }
Abackport-testcase-read.patch+63-0
@@ -0,0 +1,63 @@
1+From 0077ef29eb46d2e1df2f230fc95a1d9748d49dec Mon Sep 17 00:00:00 2001
2+From: Michael Schroeder <mls@suse.de>
3+Date: Mon, 14 Dec 2020 11:12:00 +0100
4+Subject: [PATCH] testcase_read: error out if repos are added or the system is
5+ changed too late
6+ 
7+We must not add new solvables after the considered map was created, the solver
8+was created, or jobs were added. We may not changed the system after jobs have
9+been added.
10+ 
11+(Jobs may point inside the whatproviedes array, so we must not invalidate this
12+area.)
13+---
14+ ext/testcase.c | 21 +++++++++++++++++++++
15+ 1 file changed, 21 insertions(+)
16+ 
17+diff --git a/ext/testcase.c b/ext/testcase.c
18+index 0be7a213..8fb6d793 100644
19+--- a/ext/testcase.c
20++++ b/ext/testcase.c
21+@@ -1991,6 +1991,7 @@ testcase_read(Pool *pool, FILE *fp, const char *testcase, Queue *job, char **res
22+ Id *genid = 0;
23+ int ngenid = 0;
24+ Queue autoinstq;
25++ int oldjobsize = job ? job->count : 0;
26+
27+ if (resultp)
28+ *resultp = 0;
29+@@ -2065,6 +2066,21 @@ testcase_read(Pool *pool, FILE *fp, const char *testcase, Queue *job, char **res
30+ int prio, subprio;
31+ const char *rdata;
32+
33++ if (pool->considered)
34++ {
35++ pool_error(pool, 0, "testcase_read: cannot add repos after packages were disabled");
36++ continue;
37++ }
38++ if (solv)
39++ {
40++ pool_error(pool, 0, "testcase_read: cannot add repos after the solver was created");
41++ continue;
42++ }
43++ if (job && job->count != oldjobsize)
44++ {
45++ pool_error(pool, 0, "testcase_read: cannot add repos after jobs have been created");
46++ continue;
47++ }
48+ prepared = 0;
49+ if (!poolflagsreset)
50+ {
51+@@ -2125,6 +2141,11 @@ testcase_read(Pool *pool, FILE *fp, const char *testcase, Queue *job, char **res
52+ int i;
53+
54+ /* must set the disttype before the arch */
55++ if (job && job->count != oldjobsize)
56++ {
57++ pool_error(pool, 0, "testcase_read: cannot change the system after jobs have been created");
58++ continue;
59++ }
60+ prepared = 0;
61+ if (strcmp(pieces[2], "*") != 0)
62+ {
63+ 
Alibsolv-0.7.14.tar.gz+0-0
Binary files do not support preview
Dlibsolv-0.7.7.tar.gz+0-0
Binary files do not support preview
Mlibsolv.spec+49-2
@@ -14,12 +14,23 @@
14%bcond_without zstd14%bcond_without zstd
15 15 
16Name: libsolv16Name: libsolv
17-Version: 0.7.717+Version: 0.7.14
18-Release: 2 18+Release: 7
19Summary: Package dependency solver 19Summary: Package dependency solver
20License: BSD20License: BSD
21URL: https://github.com/openSUSE/libsolv21URL: https://github.com/openSUSE/libsolv
22Source: https://github.com/openSUSE/libsolv/archive/%{version}/%{name}-%{version}.tar.gz22Source: https://github.com/openSUSE/libsolv/archive/%{version}/%{name}-%{version}.tar.gz
23+ 
24+Patch0: Fix-memory-leaks.patch
25+Patch1: Fix-segfault-in-resolve_jobrules.patch
26+Patch2: Fix-Memory-leaks-in-SWIG-generated-code-for-Python.patch
27+Patch3: use-memmove-for-overlapping-regions.patch
28+Patch4: backport-CVE-2026-48863.patch
29+ 
30+#fix CVE-2021-3200,CVE-2021-44568,CVE-2021-44569,CVE-2021-44571,CVE-2021-44573,CVE-2021-44574,CVE-2021-44575,CVE-2021-44576,CVE-2021-44577,CVE-2021-33938,CVE-2021-33929,CVE-2021-33928,CVE-2021-33930
31+ 
32+Patch6000: backport-testcase-read.patch
33+ 
23BuildRequires: cmake gcc-c++ ninja-build pkgconfig(rpm) zlib-devel34BuildRequires: cmake gcc-c++ ninja-build pkgconfig(rpm) zlib-devel
24BuildRequires: libxml2-devel xz-devel bzip2-devel libzstd-devel 35BuildRequires: libxml2-devel xz-devel bzip2-devel libzstd-devel
25Requires: %{_bindir}/find %{_bindir}/curl %{_bindir}/gpg236Requires: %{_bindir}/find %{_bindir}/curl %{_bindir}/gpg2
@@ -186,5 +197,41 @@ Python 3 version.
186%{_mandir}/man3/%{name}*.3*197%{_mandir}/man3/%{name}*.3*
187 198 
188%changelog199%changelog
200+* Mon Nov 02 2026 sunyanan <sunyanan@xfusion.com> - 0.7.14-7
201+- backport fix for CVE-2026-48863
202+ 
203+* Fir Mar 04 2022 xingxing <xingxing9@h-partners.com> - 0.7.14-6
204+- Type:cves
205+- CVE:CVE-2021-3200-CVE-2021-44568-CVE-2021-44569-CVE-2021-44571-CVE-2021-44573-CVE-2021-44574-CVE-2021-44575-CVE-2021-44576-CVE-2021-44577
206+- SUG:NA
207+- DESC:fix CVE-2021-3200-CVE-2021-44568-CVE-2021-44569-CVE-2021-44571-CVE-2021-44573-CVE-2021-44574-CVE-2021-44575-CVE-2021-44576-CVE-2021-44577
208+ 
209+* Fir Mar 04 2022 xingxing <xingxing9@h-partners.com> - 0.7.14-5
210+- Type:bugfix
211+- CVE:NA
212+- SUG:NA
213+- DESC:backport patches
214+ 
215+* Tue Aur 3 2021 Jianmin <jianmin@iscas.ac.cn> - 0.7.14-4
216+- Type:enhancement
217+- ID:NA
218+- SUG:NA
219+- DESC:remove libsolv-help dependency
220+ 
221+* Fri May 28 2021 gaihuiying <gaihuiying1@huawei.com> - 0.7.14-3
222+- Type:cves
223+- CVE:CVE-2021-3200
224+- SUG:NA
225+- DESC:fix CVE-2021-3200
226+ 
227+* Mon Nov 09 2020 xihaochen <xihaochen@huawei.com> - 0.7.14-2
228+- Type:requirement
229+- CVE:NA
230+- SUG:NA
231+- DESC:add libsolv-help dependency for libsolv
232+ 
233+* Tue Aug 04 2020 shanzhikun <shanzhikun@huawei.com> - 0.7.14-1
234+- upgrade libsolv to 0.7.14.
235+ 
189* Tue Jan 7 2020 openEuler Buildteam <buildteam@openeuler.org> - 0.7.7-2 236* Tue Jan 7 2020 openEuler Buildteam <buildteam@openeuler.org> - 0.7.7-2
190- Pakcage init237- Pakcage init
Ause-memmove-for-overlapping-regions.patch+25-0
@@ -0,0 +1,25 @@
1+From ccc2ec885a81de137c30fd0deb8c5475440e5287 Mon Sep 17 00:00:00 2001
2+From: Wolf Vollprecht <w.vollprecht@gmail.com>
3+Date: Thu, 8 Jul 2021 09:13:19 +0200
4+Subject: [PATCH] use memmove for overlapping regions
5+ 
6+Conflict:NA
7+Reference:https://github.com/openSUSE/libsolv/commit/ccc2ec885a81de137c30fd0deb8c5475440e5287.patch
8+ 
9+---
10+ src/conda.c | 2 +-
11+ 1 file changed, 1 insertion(+), 1 deletion(-)
12+ 
13+diff --git a/src/conda.c b/src/conda.c
14+index 21ad6bfb..6f6a65a6 100644
15+--- a/src/conda.c
16++++ b/src/conda.c
17+@@ -670,7 +670,7 @@ pool_conda_matchspec(Pool *pool, const char *name)
18+ if (build)
19+ {
20+ *p++ = ' ';
21+- memcpy(p, build, buildend - build);
22++ memmove(p, build, buildend - build);
23+ p += buildend - build;
24+ }
25+ evrid = pool_strn2id(pool, version, p - version, 1);