Fix a memory leak in parse_package() of repo conda

Resolves: RHEL-25498

Signed-off-by: David Cantrell <dcantrell@redhat.com>

.libsolv.metadata

@@ -0,0 +1 @@
+d5bcae967154dd1e904fd90cc17f5dce3da646f8 libsolv-0.7.24.tar.gz

0006-Allow_break_arch_lock_step_on_erase.patch

@@ -0,0 +1,125 @@
+From ab2ca3eb281c7be17ac23d28c3a57f357555ea04 Mon Sep 17 00:00:00 2001
+From: Michael Schroeder <mls@suse.de>
+Date: Wed, 19 Apr 2023 13:09:10 +0200
+Subject: [PATCH] Allow to break arch lock-step on erase operations
+
+We allow it if SOLVER_SETARCH is (auto-)set in the erase job.
+---
+ src/rules.c | 26 ++++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+diff --git a/src/rules.c b/src/rules.c
+index 008d5940..6dee4c64 100644
+--- a/src/rules.c
++++ b/src/rules.c
+@@ -1672,6 +1672,16 @@ solver_addinfarchrules(Solver *solv, Map *addedmap)
+       if (first)
+ 	continue;		/* not the first in the group */
+ 
++      if (!bestscore && allowedarchs.count > 1 && pool->implicitobsoleteusescolors)
++	{
++	  for (j = 0; j < allowedarchs.count; j++)
++	    {
++	      a = pool_arch2score(pool, allowedarchs.elements[j]);
++	      if (a && a != 1 && (!bestscore || a < bestscore))
++		bestscore = a;
++	    }
++	}
++
+       if (!bestscore)
+ 	continue;		/* did not find a score for this group */
+ 
+@@ -2578,6 +2588,20 @@ jobtodisablelist(Solver *solv, Id how, Id what, Queue *q)
+     case SOLVER_ERASE:
+       if (!installed)
+ 	break;
++      set = how & SOLVER_SETMASK;
++      if (!(set & (SOLVER_NOAUTOSET | SOLVER_SETARCH)) && pool->implicitobsoleteusescolors && solv->infarchrules != solv->infarchrules_end)
++	{
++	  if (select == SOLVER_SOLVABLE)
++	    set |= SOLVER_SETARCH;
++	  else if ((select == SOLVER_SOLVABLE_NAME || select == SOLVER_SOLVABLE_PROVIDES) && ISRELDEP(what))
++	    {
++	      Reldep *rd = GETRELDEP(pool, what);
++	      if (rd->flags <= 7 && ISRELDEP(rd->name))
++		rd = GETRELDEP(pool, rd->name);
++	      if (rd->flags == REL_ARCH)
++		set |= SOLVER_SETARCH;
++	    }
++	}
+       if (select == SOLVER_SOLVABLE_ALL || (select == SOLVER_SOLVABLE_REPO && what == installed->repoid))
+ 	{
+ 	  FOR_REPO_SOLVABLES(installed, p, s)
+@@ -2587,6 +2611,8 @@ jobtodisablelist(Solver *solv, Id how, Id what, Queue *q)
+ 	if (pool->solvables[p].repo == installed)
+ 	  {
+ 	    queue_push2(q, DISABLE_UPDATE, p);
++	    if ((set & SOLVER_SETARCH) != 0 && pool->implicitobsoleteusescolors && solv->infarchrules != solv->infarchrules_end)
++	      queue_push2(q, DISABLE_INFARCH, pool->solvables[p].name);		/* allow to break the lock-step */
+ #ifdef ENABLE_LINKED_PKGS
+ 	    if (solv->instbuddy && solv->instbuddy[p - installed->start] > 1)
+ 	      queue_push2(q, DISABLE_UPDATE, solv->instbuddy[p - installed->start]);
+-- 
+2.40.1
+
+
+From 847f3f1b21f8c396c831564f849981a450c67dbf Mon Sep 17 00:00:00 2001
+From: Michael Schroeder <mls@suse.de>
+Date: Fri, 21 Apr 2023 16:15:10 +0200
+Subject: [PATCH] Only disable infarch rules on erase if the package was in
+ lock-step
+
+Fiexes issue #528
+---
+ src/rules.c | 28 +++++++++++++++++++++++++++-
+ 1 file changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/src/rules.c b/src/rules.c
+index 6dee4c64..54fefcb8 100644
+--- a/src/rules.c
++++ b/src/rules.c
+@@ -2367,6 +2367,31 @@ reenablerepopriorule(Solver *solv, Id name)
+ #define DISABLE_BLACK	 4
+ #define DISABLE_REPOPRIO 5
+ 
++/* check if installed package p is in lock-step with another installed package */
++static int
++installed_is_in_lockstep(Solver *solv, Id p)
++{
++  Pool *pool = solv->pool;
++  Repo *installed = solv->installed;
++  int rid;
++  Id pp, l;
++  Rule *r;
++
++  if (!installed)
++    return 0;
++  for (rid = solv->infarchrules, r = solv->rules + rid; rid < solv->infarchrules_end; rid++, r++)
++    {
++      if (r->p >= 0)
++	continue;
++      if (pool->solvables[-r->p].repo != installed)
++	continue;
++      FOR_RULELITERALS(l, pp, r)
++	if (l == p)
++	  return 1;
++    }
++  return 0;
++}
++
+ static void
+ jobtodisablelist(Solver *solv, Id how, Id what, Queue *q)
+ {
+@@ -2612,7 +2637,8 @@ jobtodisablelist(Solver *solv, Id how, Id what, Queue *q)
+ 	  {
+ 	    queue_push2(q, DISABLE_UPDATE, p);
+ 	    if ((set & SOLVER_SETARCH) != 0 && pool->implicitobsoleteusescolors && solv->infarchrules != solv->infarchrules_end)
+-	      queue_push2(q, DISABLE_INFARCH, pool->solvables[p].name);		/* allow to break the lock-step */
++	      if (installed_is_in_lockstep(solv, p))
++	        queue_push2(q, DISABLE_INFARCH, pool->solvables[p].name);		/* allow to break the lock-step */
+ #ifdef ENABLE_LINKED_PKGS
+ 	    if (solv->instbuddy && solv->instbuddy[p - installed->start] > 1)
+ 	      queue_push2(q, DISABLE_UPDATE, solv->instbuddy[p - installed->start]);
+-- 
+2.40.1
+

libsolv-0.7.24-repo_conda-overwrite-the-package-subdir-with-the-inf.patch

@@ -0,0 +1,41 @@
+From 86717630b78f015ed3e0d41aa299cdde532b9c6f Mon Sep 17 00:00:00 2001
+From: Michael Schroeder <mls@suse.de>
+Date: Fri, 21 Jul 2023 13:53:46 +0200
+Subject: [PATCH] repo_conda: overwrite the package subdir with the info subdir
+ if there is a conflict
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This is what classic conda does, so we also need to do it.
+Fixes issue #529
+
+Signed-off-by: Petr Písař <ppisar@redhat.com>
+---
+ ext/repo_conda.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/ext/repo_conda.c b/ext/repo_conda.c
+index 9211cbea..356d3b11 100644
+--- a/ext/repo_conda.c
++++ b/ext/repo_conda.c
+@@ -314,8 +314,16 @@ parse_package(struct parsedata *pd, struct solv_jsonparser *jp, char *kfn, char
+   /* if we have a global subdir make sure that it matches */
+   if (subdir && pd->subdir && strcmp(subdir, pd->subdir) != 0)
+     {
++      /* we used to return an error here, but classic conda
++       * just overwrites the package subdir with the global
++       * subdir */
++#if 0
+       pd->error = "subdir mismatch";
+       return JP_ERROR;
++#else
++      solv_free(subdir);
++      subdir = solv_strdup(pd->subdir);
++#endif
+     }
+ 
+   if (fn || kfn)
+-- 
+2.44.0
+

libsolv-0.7.24-static_analysis_fixes.patch

@@ -0,0 +1,34 @@
+diff -up libsolv-0.7.24/ext/repo_rpmmd.c.orig libsolv-0.7.24/ext/repo_rpmmd.c
+--- libsolv-0.7.24/ext/repo_rpmmd.c.orig	2023-04-13 10:10:14.000000000 -0400
++++ libsolv-0.7.24/ext/repo_rpmmd.c	2024-04-08 14:00:05.923253315 -0400
+@@ -609,6 +609,8 @@ fill_cshash_from_new_solvables(struct pa
+   KeyValue kv;
+   Repokey *key;
+ 
++  memset(&kv, 0, sizeof(kv));
++
+   for (i = pd->first; i < pool->nsolvables; i++)
+     {
+       if (pool->solvables[i].repo != pd->repo)
+diff -up libsolv-0.7.24/ext/repo_susetags.c.orig libsolv-0.7.24/ext/repo_susetags.c
+--- libsolv-0.7.24/ext/repo_susetags.c.orig	2023-04-13 10:10:14.000000000 -0400
++++ libsolv-0.7.24/ext/repo_susetags.c	2024-04-08 14:00:50.560276418 -0400
+@@ -339,6 +339,7 @@ lookup_shared_id(Repodata *data, Id p, I
+   if (uninternalized)
+     {
+       KeyValue kv;
++      memset(&kv, 0, sizeof(kv));
+       Repokey *key = repodata_lookup_kv_uninternalized(data, p, keyname, &kv);
+       if (!key)
+         return 0;
+diff -up libsolv-0.7.24/ext/testcase.c.orig libsolv-0.7.24/ext/testcase.c
+--- libsolv-0.7.24/ext/testcase.c.orig	2023-04-13 10:10:14.000000000 -0400
++++ libsolv-0.7.24/ext/testcase.c	2024-04-08 14:12:49.660462318 -0400
+@@ -1497,6 +1497,7 @@ testcase_solverresult(Solver *solv, int
+   if ((resultflags & TESTCASE_RESULT_USERINSTALLED) != 0)
+     {
+       Queue q;
++      queue_init(&q);
+       solver_get_userinstalled(solv, &q, 0);
+       for (i = 0; i < q.count; i++)
+ 	{

libsolv.spec

@@ -23,7 +23,7 @@
 
 Name:           lib%{libname}
 Version:        0.7.24
-Release:        1%{?dist}
+Release:        3%{?dist}
 Summary:        Package dependency solver
 
 License:        BSD
@@ -35,6 +35,9 @@ Patch2:         0002-Revert-Improve-choice-rule-generation.patch
 Patch3:         0003-Revert-Add-complex_deps-requirement-to-choice1b-test.patch
 Patch4:         0004-Revert-Add-more-choicerules-tests.patch
 Patch5:         0005-Treat-condition-both-as-positive-and-negative-litera.patch
+Patch6:         0006-Allow_break_arch_lock_step_on_erase.patch
+Patch7:         libsolv-0.7.24-static_analysis_fixes.patch
+Patch8:         libsolv-0.7.24-repo_conda-overwrite-the-package-subdir-with-the-inf.patch
 
 BuildRequires:  cmake
 BuildRequires:  gcc-c++
@@ -261,6 +264,14 @@ export LD_LIBRARY_PATH=%{buildroot}%{_libdir}
 %endif
 
 %changelog
+* Tue Apr 09 2024 Petr Pisar <ppisar@redhat.com> - 0.7.24-3
+- Some static analysis fixes for unitialized structs
+  Resolves: RHEL-25498
+- Fix a memory leak in parse_package() of repo conda (RHEL-25496)
+
+* Wed Jun 21 2023 Jaroslav Rohel <jrohel@redhat.com> - 0.7.24-2
+- Backport Allow to break arch lock-step on erase operations (RhBug:2172288,2172292)
+
 * Tue May 16 2023 Jaroslav Rohel <jrohel@redhat.com> - 0.7.24-1
 - Update to 0.7.24
 - Backport Treat condition both as positive and negative literal in pool_add_pos_literals_complex_dep