libpcp_web: fix double-free in pmwebapi

已开启

libpcp_web: fix double-free in pmwebapi_labelsetdup #151

liuh0329创建于 9月11日从liuh0329/pcp： master 合入到 src-openeuler/pcp： master

libpcp_web: fix double-free in pmwebapi_labelsetdup #151

已开启

liuh0329创建于 9月11日

从liuh0329/pcp master合入到src-openeuler/pcp master

共 2 个文件变更+68-2

Abackport-libpcp_web-fix-double-free-in-pmwebapi_labelsetdup.patch+61-0

@@ -0,0 +1,61 @@
	1	+From 26d4ca53ef4ce107aad8378826c0606a3d8b0ea7 Mon Sep 17 00:00:00 2001
	2	+From: Nathan Scott <nathans@redhat.com>
	3	+Date: Sun, 9 Aug 2026 13:37:11 +1000
	4	+Subject: [PATCH] libpcp_web: fix double-free in pmwebapi_labelsetdup
	5	+MIME-Version: 1.0
	6	+Content-Type: text/plain; charset=UTF-8
	7	+Content-Transfer-Encoding: 8bit
	8	+
	9	+pmwebapi_labelsetdup() performs a shallow struct copy (dup = lp)
	10	+and then selectively deep-copies json and labels — but only when
	11	+nlabels > 0. Two problems:
	12	+
	13	+1. When nlabels <= 0 (or json is NULL), the dup shares the json
	14	+ pointer with the source. When pmDiscoverInvokeLabelsCallBacks
	15	+ frees the source labelset after invoking callbacks, the stored
	16	+ duplicate retains the dangling pointer. The next label discovery
	17	+ cycle frees the old duplicate, double-freeing the json allocation.
	18	+
	19	+2. The compound flag and hash pointer were never handled — if set,
	20	+ the dup shares the opaque hash with the source, again leading
	21	+ to a double-free via pmFreeLabelSets.
	22	+
	23	+Fix both by clearing compound/hash immediately after the struct copy
	24	+and, for the nlabels <= 0 / NULL-json case, NULLing json, jsonlen
	25	+and labels before returning. This matches what __pmDupLabelSets in
	26	+libpcp already does correctly for the same cases.
	27	+
	28	+Resolves a pmproxy SIGABRT (double-free) in archive discovery:
	29	+ pmFreeLabelSets ← pmSeriesDiscoverLabels ←
	30	+pmDiscoverInvokeLabelsCallBacks
	31	+
	32	+Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
	33	+
	34	+Fixes: #2686
	35	+---
	36	+ src/libpcp_web/src/util.c \| 8 +++++++-
	37	+ 1 file changed, 7 insertions(+), 1 deletion(-)
	38	+
	39	+diff --git a/src/libpcp_web/src/util.c b/src/libpcp_web/src/util.c
	40	+index dc80868..f189bb4 100644
	41	+--- a/src/libpcp_web/src/util.c
	42	++++ b/src/libpcp_web/src/util.c
	43	+@@ -877,8 +877,14 @@ pmwebapi_labelsetdup(pmLabelSet *lp)
	44	+ if ((dup = calloc(1, sizeof(pmLabelSet))) == NULL)
	45	+ return NULL;
	46	+ dup = lp;
	47	+- if (lp->nlabels <= 0)
	48	++ dup->hash = NULL;
	49	++ dup->compound = 0;
	50	++ if (lp->nlabels <= 0 \|\| lp->json == NULL) {
	51	++ dup->json = NULL;
	52	++ dup->jsonlen = 0;
	53	++ dup->labels = NULL;
	54	+ return dup;
	55	++ }
	56	+ if ((json = strdup(lp->json)) == NULL) {
	57	+ free(dup);
	58	+ return NULL;
	59	+--
	60	+2.43.0
	61	+

Mpcp.spec+7-2

	@@ -2,7 +2,7 @@
2		2
3	Name: pcp	3	Name: pcp
4	Version: 6.3.8	4	Version: 6.3.8
5	-Release: 3	5	+Release: 4
6	Summary: System-level performance monitoring and performance management	6	Summary: System-level performance monitoring and performance management
7	License: GPL-2.0-or-later AND LGPL-2.1-or-later AND CC-BY-3.0	7	License: GPL-2.0-or-later AND LGPL-2.1-or-later AND CC-BY-3.0
8	URL: https://pcp.io	8	URL: https://pcp.io
	@@ -11,6 +11,8 @@ Source0: https://github.com/performancecopilot/pcp/archive/refs/tags/%{version}.
11	Patch0: fix-check-static-when-build-by-clang.patch	11	Patch0: fix-check-static-when-build-by-clang.patch
12	# CVE-2026-16530	12	# CVE-2026-16530
13	Patch1: pcp-RHEL-213747.patch	13	Patch1: pcp-RHEL-213747.patch
		14	+Patch2: backport-libpcp_web-fix-double-free-in-pmwebapi_labelsetdup.patch
		15	+
14	# The additional linker flags break out-of-tree PMDAs.	16	# The additional linker flags break out-of-tree PMDAs.
15	# https://bugzilla.redhat.com/show_bug.cgi?id=2043092	17	# https://bugzilla.redhat.com/show_bug.cgi?id=2043092
16	%undefine _package_note_flags	18	%undefine _package_note_flags
	@@ -2128,7 +2130,7 @@ updated policy package.
2128	%if "%{?toolchain}" == "clang"	2130	%if "%{?toolchain}" == "clang"
2129	%patch -P0 -p1	2131	%patch -P0 -p1
2130	%endif	2132	%endif
2131	-%patch -P1 -p1	2133	+%autopatch -p1 -m 1
2132		2134
2133	%build	2135	%build
2134	# the buildsubdir macro gets defined in %%setup and is apparently only available in the next step (i.e. the %%build step)	2136	# the buildsubdir macro gets defined in %%setup and is apparently only available in the next step (i.e. the %%build step)
	@@ -3222,6 +3224,9 @@ fi
3222		3224
3223		3225
3224	%changelog	3226	%changelog
		3227	+* Fri Sep 11 2026 liuh <liuhuan01@kylinos.cn> - 6.3.8-4
		3228	+- libpcp_web: fix double-free in pmwebapi_labelsetdup
		3229	+
3225	* Tue Sep 08 2026 xu_ping <707078654@qq.com> - 6.3.8-3	3230	* Tue Sep 08 2026 xu_ping <707078654@qq.com> - 6.3.8-3
3226	- fix CVE-2026-16530	3231	- fix CVE-2026-16530
3227		3232