Star0
11
代码
代码
Issues2
Pull Requests6
项目讨论
Wiki
分析
Star0
11
已开启
Fix CVE-2026-48863 (openEuler-20.03-LTS-SP4) #106
易大夫创建于 5 天前
Fix CVE-2026-48863 (openEuler-20.03-LTS-SP4) #106
已开启
易大夫创建于 5 天前
从sun_jie001/libsolvcve-2026-48863-cp-2f08bb4-88合入到src-openeuler/libsolvopenEuler-20.03-LTS-SP4
共 7 个文件变更+180-3
AFix-Memory-leaks-in-SWIG-generated-code-for-Python.patch+31-0
@@ -0,0 +1,31 @@
1+From 8615575144e6fd3d708a30983ed2415db479ef4c Mon Sep 17 00:00:00 2001
2+From: Jaroslav Rohel <jrohel@redhat.com>
3+Date: Thu, 8 Apr 2021 12:17:09 +0200
4+Subject: [PATCH] Fix: Memory leaks in SWIG generated code (for Python)
5+ 
6+There were memory leaks in the `Chksum_from_bin`, `Chksum_add`,
7+`SolvFp_write` functions wrapper for Python.
8+ 
9+The problem was in "freearg" typemap argument defined in "solv.i".
10+Therefore, the typemap was not applied.
11+ 
12+Conflict: NA
13+Reference: https://github.com/openSUSE/libsolv/commit/8615575144e6fd3d708a30983ed2415db479ef4c
14+ 
15+---
16+ bindings/solv.i | 2 +-
17+ 1 file changed, 1 insertion(+), 1 deletion(-)
18+ 
19+diff --git a/bindings/solv.i b/bindings/solv.i
20+index 1882b135..3bbeca04 100644
21+--- a/bindings/solv.i
22++++ b/bindings/solv.i
23+@@ -63,7 +63,7 @@ typedef struct {
24+ $2 = size;
25+ }
26+
27+-%typemap(freearg,noblock=1,match="in") (const unsigned char *str, int len) {
28++%typemap(freearg,noblock=1,match="in") (const unsigned char *str, size_t len) {
29+ if (alloc$argnum == SWIG_NEWOBJ) %delete_array(buf$argnum);
30+ }
31+
AFix-memory-leaks.patch+42-0
@@ -0,0 +1,42 @@
1+From 71c6b26096086926f48d8fced1a03ca52a1eb745 Mon Sep 17 00:00:00 2001
2+From: Jaroslav Rohel <jrohel@redhat.com>
3+Date: Mon, 29 Mar 2021 12:46:31 +0200
4+Subject: [PATCH] Fix memory leaks
5+ 
6+Conflict: NA
7+Reference: https://github.com/openSUSE/libsolv/commit/71c6b26096086926f48d8fced1a03ca52a1eb745
8+ 
9+---
10+ ext/repo_deb.c | 1 +
11+ ext/testcase.c | 4 ++--
12+ 2 files changed, 3 insertions(+), 2 deletions(-)
13+ 
14+diff --git a/ext/repo_deb.c b/ext/repo_deb.c
15+index 8f637567..34f40fa8 100644
16+--- a/ext/repo_deb.c
17++++ b/ext/repo_deb.c
18+@@ -792,5 +792,6 @@ pool_deb_get_autoinstalled(Pool *pool, FILE *fp, Queue *q, int flags)
19+ break;
20+ }
21+ }
22++ solv_free(buf);
23+ }
24+
25+diff --git a/ext/testcase.c b/ext/testcase.c
26+index 8fb6d793..4e9e3154 100644
27+--- a/ext/testcase.c
28++++ b/ext/testcase.c
29+@@ -1477,11 +1477,11 @@ testcase_solverresult(Solver *solv, int resultflags)
30+ queue_init(&q);
31+ for (rid = 1; (rclass = solver_ruleclass(solv, rid)) != SOLVER_RULE_UNKNOWN; rid++)
32+ {
33+- char *prefix = solv_dupjoin("rule ", testcase_rclass2str(rclass), " ");
34+- prefix = solv_dupappend(prefix, testcase_ruleid(solv, rid), 0);
35+ solver_ruleliterals(solv, rid, &q);
36+ if (rclass == SOLVER_RULE_FEATURE && q.count == 1 && q.elements[0] == -SYSTEMSOLVABLE)
37+ continue;
38++ char *prefix = solv_dupjoin("rule ", testcase_rclass2str(rclass), " ");
39++ prefix = solv_dupappend(prefix, testcase_ruleid(solv, rid), 0);
40+ for (i = 0; i < q.count; i++)
41+ {
42+ Id p = q.elements[i];
AFix-segfault-in-resolve_jobrules.patch+28-0
@@ -0,0 +1,28 @@
1+From 0ecd4f310318d9bd91db48e5c9dc7e749fbed82a Mon Sep 17 00:00:00 2001
2+From: Thomas Lam <79589038+tl-hbk@users.noreply.github.com>
3+Date: Tue, 30 Mar 2021 05:33:52 -0700
4+Subject: [PATCH] Fix segfault in resolve_jobrules
5+ 
6+In selectandinstall sometimes rules are added and a realloc is required if there's
7+no more memory available in the allocated block. r-- would just decrement the old
8+pointer but the realloc could return a completely different block of memory
9+ 
10+Conflict: NA
11+Reference: https://github.com/openSUSE/libsolv/commit/0ecd4f310318d9bd91db48e5c9dc7e749fbed82a
12+ 
13+---
14+ src/solver.c | 1 +
15+ 1 file changed, 1 insertion(+)
16+ 
17+diff --git a/src/solver.c b/src/solver.c
18+index 9c02cc76..89a2ed10 100644
19+--- a/src/solver.c
20++++ b/src/solver.c
21+@@ -1629,6 +1629,7 @@ resolve_jobrules(Solver *solv, int level, int disablerules, Queue *dq)
22+ }
23+ olevel = level;
24+ level = selectandinstall(solv, level, dq, disablerules, i, SOLVER_REASON_RESOLVE_JOB);
25++ r = solv->rules + i; /* selectandinstall may have added more rules */
26+ if (level <= olevel)
27+ {
28+ if (level == olevel)
Abackport-CVE-2026-48863.patch+22-0
@@ -0,0 +1,22 @@
1+From 44f8c085045b1f771641091bbb2b810d12cff9e8 Mon Sep 17 00:00:00 2001
2+From: Michael Schroeder <mls@suse.de>
3+Date: Tue, 26 May 2026 10:30:31 +0200
4+Subject: [PATCH] Fix wrong variable being used in solv_pgpvrfy
5+ 
6+---
7+ ext/solv_pgpvrfy.c | 2 +-
8+ 1 file changed, 1 insertion(+), 1 deletion(-)
9+ 
10+diff --git a/ext/solv_pgpvrfy.c b/ext/solv_pgpvrfy.c
11+index 9f1bd72e6..9358558bc 100644
12+--- a/ext/solv_pgpvrfy.c
13++++ b/ext/solv_pgpvrfy.c
14+@@ -589,7 +589,7 @@ solv_pgpvrfy(const unsigned char *pub, int publ, const unsigned char *sig, int s
15+ if (rlen)
16+ memcpy(sigdata + 32 - rlen, r, rlen);
17+ if (slen)
18+- memcpy(sigdata + 64 - slen, s, rlen);
19++ memcpy(sigdata + 64 - slen, s, slen);
20+ res = mped25519(pub + 1 + 10 + 2 + 1, sigdata, sig + 2, hashl);
21+ break;
22+ }
RCVE-2021-3200.patch→backport-testcase-read.patch+0-0
文件重命名但无更改。
Mlibsolv.spec+32-3
@@ -15,17 +15,25 @@
15 15 
16Name: libsolv16Name: libsolv
17Version: 0.7.1417Version: 0.7.14
18-Release: 318+Release: 7
19Summary: Package dependency solver 19Summary: Package dependency solver
20License: BSD20License: BSD
21URL: https://github.com/openSUSE/libsolv21URL: https://github.com/openSUSE/libsolv
22Source: https://github.com/openSUSE/libsolv/archive/%{version}/%{name}-%{version}.tar.gz22Source: https://github.com/openSUSE/libsolv/archive/%{version}/%{name}-%{version}.tar.gz
23 23 
24-Patch0: CVE-2021-3200.patch24+Patch0: Fix-memory-leaks.patch
25+Patch1: Fix-segfault-in-resolve_jobrules.patch
26+Patch2: Fix-Memory-leaks-in-SWIG-generated-code-for-Python.patch
27+Patch3: use-memmove-for-overlapping-regions.patch
28+Patch4: backport-CVE-2026-48863.patch
29+ 
30+#fix CVE-2021-3200,CVE-2021-44568,CVE-2021-44569,CVE-2021-44571,CVE-2021-44573,CVE-2021-44574,CVE-2021-44575,CVE-2021-44576,CVE-2021-44577,CVE-2021-33938,CVE-2021-33929,CVE-2021-33928,CVE-2021-33930
31+ 
32+Patch6000: backport-testcase-read.patch
25 33 
26BuildRequires: cmake gcc-c++ ninja-build pkgconfig(rpm) zlib-devel34BuildRequires: cmake gcc-c++ ninja-build pkgconfig(rpm) zlib-devel
27BuildRequires: libxml2-devel xz-devel bzip2-devel libzstd-devel 35BuildRequires: libxml2-devel xz-devel bzip2-devel libzstd-devel
28-Requires: %{_bindir}/find %{_bindir}/curl %{_bindir}/gpg2 %{name}-help36+Requires: %{_bindir}/find %{_bindir}/curl %{_bindir}/gpg2
29Provides: libsolv-tools libsolv-demo37Provides: libsolv-tools libsolv-demo
30Obsoletes: libsolv-tools < %{version}-%{release}38Obsoletes: libsolv-tools < %{version}-%{release}
31Obsoletes: libsolv-demo < %{version}-%{release}39Obsoletes: libsolv-demo < %{version}-%{release}
@@ -189,6 +197,27 @@ Python 3 version.
189%{_mandir}/man3/%{name}*.3*197%{_mandir}/man3/%{name}*.3*
190 198 
191%changelog199%changelog
200+* Mon Nov 02 2026 sunyanan <sunyanan@xfusion.com> - 0.7.14-7
201+- backport fix for CVE-2026-48863
202+ 
203+* Fir Mar 04 2022 xingxing <xingxing9@h-partners.com> - 0.7.14-6
204+- Type:cves
205+- CVE:CVE-2021-3200-CVE-2021-44568-CVE-2021-44569-CVE-2021-44571-CVE-2021-44573-CVE-2021-44574-CVE-2021-44575-CVE-2021-44576-CVE-2021-44577
206+- SUG:NA
207+- DESC:fix CVE-2021-3200-CVE-2021-44568-CVE-2021-44569-CVE-2021-44571-CVE-2021-44573-CVE-2021-44574-CVE-2021-44575-CVE-2021-44576-CVE-2021-44577
208+ 
209+* Fir Mar 04 2022 xingxing <xingxing9@h-partners.com> - 0.7.14-5
210+- Type:bugfix
211+- CVE:NA
212+- SUG:NA
213+- DESC:backport patches
214+ 
215+* Tue Aur 3 2021 Jianmin <jianmin@iscas.ac.cn> - 0.7.14-4
216+- Type:enhancement
217+- ID:NA
218+- SUG:NA
219+- DESC:remove libsolv-help dependency
220+ 
192* Fri May 28 2021 gaihuiying <gaihuiying1@huawei.com> - 0.7.14-3221* Fri May 28 2021 gaihuiying <gaihuiying1@huawei.com> - 0.7.14-3
193- Type:cves222- Type:cves
194- CVE:CVE-2021-3200223- CVE:CVE-2021-3200
Ause-memmove-for-overlapping-regions.patch+25-0
@@ -0,0 +1,25 @@
1+From ccc2ec885a81de137c30fd0deb8c5475440e5287 Mon Sep 17 00:00:00 2001
2+From: Wolf Vollprecht <w.vollprecht@gmail.com>
3+Date: Thu, 8 Jul 2021 09:13:19 +0200
4+Subject: [PATCH] use memmove for overlapping regions
5+ 
6+Conflict:NA
7+Reference:https://github.com/openSUSE/libsolv/commit/ccc2ec885a81de137c30fd0deb8c5475440e5287.patch
8+ 
9+---
10+ src/conda.c | 2 +-
11+ 1 file changed, 1 insertion(+), 1 deletion(-)
12+ 
13+diff --git a/src/conda.c b/src/conda.c
14+index 21ad6bfb..6f6a65a6 100644
15+--- a/src/conda.c
16++++ b/src/conda.c
17+@@ -670,7 +670,7 @@ pool_conda_matchspec(Pool *pool, const char *name)
18+ if (build)
19+ {
20+ *p++ = ' ';
21+- memcpy(p, build, buildend - build);
22++ memmove(p, build, buildend - build);
23+ p += buildend - build;
24+ }
25+ evrid = pool_strn2id(pool, version, p - version, 1);