Star0
11
Code
Code
Issues2
Pull Requests6
Discussion
Wiki
Analysis
Star0
11
Open
backport 4 upstream bug fixes for issue #44 (roundup) #108
huijing_zhangAdd on 2 days ago
backport 4 upstream bug fixes for issue #44 (roundup) #108
Open
huijing_zhangAdd on 2 days ago
Merged fromhuijing_zhang/libsolvbackport-bugfix-bundle-2403sp3intosrc-openeuler/libsolvopenEuler-24.03-LTS-SP3
Total: 5 files changed+153-1
Abackport-Fix-NULL-pointer-dereference-in-solv_chksum_free.patch+24-0
@@ -0,0 +1,24 @@
1+From 107f91c5d2d9af668c6267cd89c581a9dfc9d540 Mon Sep 17 00:00:00 2001
2+From: Michael Schroeder <mls@suse.de>
3+Date: 2026-05-28
4+Subject: [PATCH] Fix NULL pointer dereference in solv_chksum_free()
5+ 
6+Backport to libsolv 0.7.24 for openEuler issue #44 (roundup of upstream bug fixes).
7+ 
8+solv_chksum_free() dereferenced a NULL chksum pointer when called with cp != NULL and chk == NULL. Add an early return.
9+ 
10+Upstream commit: https://github.com/openSUSE/libsolv/commit/107f91c5d2d9af668c6267cd89c581a9dfc9d540
11+---
12+diff --git a/src/chksum.c b/src/chksum.c
13+index 0000000..1111111 100644
14+--- a/src/chksum.c
15++++ b/src/chksum.c
16+@@ -251,6 +251,8 @@
17+ void *
18+ solv_chksum_free(Chksum *chk, unsigned char *cp)
19+ {
20++ if (!chk)
21++ return 0;
22+ if (cp)
23+ {
24+ const unsigned char *res;
Abackport-Fix-logic-error-in-allochashtable.patch+24-0
@@ -0,0 +1,24 @@
1+From 40d41ab1985cf8693b443314337231156210bf9a Mon Sep 17 00:00:00 2001
2+From: Michael Schroeder <mls@suse.de>
3+Date: 2026-05-15
4+Subject: [PATCH] Fix logic error in allochashtable
5+ 
6+Backport to libsolv 0.7.24 for openEuler issue #44 (roundup of upstream bug fixes).
7+ 
8+The idarray hash table was resized only when the size strictly exceeded the mask threshold, dropping entries at the exact boundary. Correct the comparison. (The upstream allochashtable code itself does not exist in 0.7.24; only the repo.c idarrayhash part of the fix applies.)
9+ 
10+Upstream commit: https://github.com/openSUSE/libsolv/commit/40d41ab1985cf8693b443314337231156210bf9a
11+---
12+diff --git a/src/repo.c b/src/repo.c
13+index 0000000..1111111 100644
14+--- a/src/repo.c
15++++ b/src/repo.c
16+@@ -393,7 +393,7 @@
17+ if (repo->lastidhash_idarraysize != repo->idarraysize || (Hashval)size * 2 > repo->lastidhash_mask || repo->lastmarker != marker)
18+ {
19+ repo->lastmarkerpos = 0;
20+- if ((Hashval)size * 2 > repo->lastidhash_mask)
21++ if ((Hashval)size * 2 >= repo->lastidhash_mask)
22+ {
23+ repo->lastidhash_mask = mkmask(size < REPO_ADDID_DEP_HASHMIN ? REPO_ADDID_DEP_HASHMIN : size);
24+ repo->lastidhash = solv_realloc2(repo->lastidhash, repo->lastidhash_mask + 1, sizeof(Id));
Abackport-Limit-the-allowed-number-of-languages.patch+40-0
@@ -0,0 +1,40 @@
1+From f569b91be3c3d11407aab9a29f719c53c0e13cb2 Mon Sep 17 00:00:00 2001
2+From: Michael Schroeder <mls@suse.de>
3+Date: 2026-04-29
4+Subject: [PATCH] Limit the allowed number of languages
5+ 
6+Backport to libsolv 0.7.24 for openEuler issue #44 (roundup of upstream bug fixes).
7+ 
8+pool_set_languages() aborts when the language count is negative or >= 1024, and the language cache in solvable_lookup_str_poollang() is allocated with the correct operand order. (Adapted: solv_ovfl() does not exist in 0.7.24, use fprintf+abort instead.)
9+ 
10+Upstream commit: https://github.com/openSUSE/libsolv/commit/f569b91be3c3d11407aab9a29f719c53c0e13cb2
11+---
12+diff --git a/src/pool.c b/src/pool.c
13+index 0000000..1111111 100644
14+--- a/src/pool.c
15++++ b/src/pool.c
16+@@ -1690,6 +1690,11 @@
17+ for (i = 0; i < pool->nlanguages; i++)
18+ free((char *)pool->languages[i]);
19+ pool->languages = solv_free((void *)pool->languages);
20++ if (nlanguages < 0 || nlanguages >= 1024)
21++ {
22++ fprintf(stderr, "language count overflow\n");
23++ abort();
24++ }
25+ pool->nlanguages = nlanguages;
26+ if (!nlanguages)
27+ return;
28+diff --git a/src/solvable.c b/src/solvable.c
29+index 0000000..1111111 100644
30+--- a/src/solvable.c
31++++ b/src/solvable.c
32+@@ -216,7 +216,7 @@
33+ cols = pool->nlanguages + 1;
34+ if (!pool->languagecache)
35+ {
36+- pool->languagecache = solv_calloc(cols * ID_NUM_INTERNAL, sizeof(Id));
37++ pool->languagecache = solv_calloc(ID_NUM_INTERNAL, cols * sizeof(Id));
38+ pool->languagecacheother = 0;
39+ }
40+ if (keyname >= ID_NUM_INTERNAL)
Abackport-solv_xmlparser-truncate-oversized-element-content.patch+55-0
@@ -0,0 +1,55 @@
1+From 7439b0dc89d4c8cf669d6fb06cdb02a3919bbe8a Mon Sep 17 00:00:00 2001
2+From: Michael Schroeder <mls@suse.de>
3+Date: 2026-05-06
4+Subject: [PATCH] solv_xmlparser: truncate oversized element content
5+ 
6+Backport to libsolv 0.7.24 for openEuler issue #44 (roundup of upstream bug fixes).
7+ 
8+Guard against integer overflows in the element content buffer: ignore content chunks that would overflow the 0x40000000 limit, and fail allocation when a single element content exceeds it.
9+ 
10+Upstream commit: https://github.com/openSUSE/libsolv/commit/7439b0dc89d4c8cf669d6fb06cdb02a3919bbe8a
11+---
12+diff --git a/ext/solv_xmlparser.c b/ext/solv_xmlparser.c
13+index 0000000..1111111 100644
14+--- a/ext/solv_xmlparser.c
15++++ b/ext/solv_xmlparser.c
16+@@ -29,10 +29,10 @@
17+ {
18+ l += xmlp->lcontent + 1; /* plus room for trailing zero */
19+ if (l > xmlp->acontent)
20+- {
21++ {
22+ xmlp->acontent = l + 256;
23+ xmlp->content = solv_realloc(xmlp->content, xmlp->acontent);
24+- }
25++ }
26+ }
27+
28+
29+@@ -46,8 +46,10 @@
30+ {
31+ struct solv_xmlparser *xmlp = userData;
32+
33+- if (!xmlp->docontent || !len)
34++ if (!xmlp->docontent || len <= 0)
35+ return;
36++ if ((unsigned int)xmlp->lcontent + (unsigned int)len >= 0x40000000U)
37++ return; /* hey! just ignore for now */
38+ add_contentspace(xmlp, len);
39+ memcpy(xmlp->content + xmlp->lcontent, s, len);
40+ xmlp->lcontent += len;
41+@@ -369,10 +371,12 @@
42+ {
43+ xmlp->lcontent = 0;
44+ if (l > xmlp->acontent)
45+- {
46++ {
47++ if ((unsigned int)l >= 0x40000000U)
48++ solv_oom(0, l);
49+ xmlp->acontent = l + 256;
50+ xmlp->content = solv_realloc(xmlp->content, xmlp->acontent);
51+- }
52++ }
53+ return xmlp->content;
54+ }
55+
Mlibsolv.spec+10-1
@@ -15,7 +15,7 @@
15 15 
16Name: libsolv16Name: libsolv
17Version: 0.7.2417Version: 0.7.24
18-Release: 518+Release: 6
19Summary: Package dependency solver 19Summary: Package dependency solver
20License: BSD20License: BSD
21URL: https://github.com/openSUSE/libsolv21URL: https://github.com/openSUSE/libsolv
@@ -31,6 +31,10 @@ Patch6007: backport-Handle-installed-packages-in-three-passes.patch
31Patch6008: backport-CVE-2026-9149.patch31Patch6008: backport-CVE-2026-9149.patch
32Patch6009: backport-CVE-2026-9150.patch32Patch6009: backport-CVE-2026-9150.patch
33Patch6010: backport-CVE-2026-48863.patch33Patch6010: backport-CVE-2026-48863.patch
34+Patch6011: backport-Fix-NULL-pointer-dereference-in-solv_chksum_free.patch
35+Patch6012: backport-Fix-logic-error-in-allochashtable.patch
36+Patch6013: backport-solv_xmlparser-truncate-oversized-element-content.patch
37+Patch6014: backport-Limit-the-allowed-number-of-languages.patch
34 38 
35BuildRequires: cmake gcc-c++ ninja-build pkgconfig(rpm) zlib-devel39BuildRequires: cmake gcc-c++ ninja-build pkgconfig(rpm) zlib-devel
36BuildRequires: libxml2-devel xz-devel bzip2-devel 40BuildRequires: libxml2-devel xz-devel bzip2-devel
@@ -224,6 +228,11 @@ Python 3 version.
224%{_mandir}/man3/%{name}*.3*228%{_mandir}/man3/%{name}*.3*
225 229 
226%changelog230%changelog
231+* Fri Nov 07 2026 huijing_zhang <huijing_zhang@ahoynetworks.com> - 0.7.24-6
232+- backport 4 upstream bug fixes for issue #44 (roundup):
233+ solv_chksum_free NULL deref, allochashtable logic error,
234+ xmlparser oversized content, languages limit
235+ 
227* Mon Jun 1 2026 zhusicong <zhusicong@h-partners.com> - 0.7.24-5236* Mon Jun 1 2026 zhusicong <zhusicong@h-partners.com> - 0.7.24-5
228- fix CVE-2026-48863237- fix CVE-2026-48863
229 238