From 2c4b27a61bcc4b34c0b0e5509dd23478c95b19c3 Mon Sep 17 00:00:00 2001
From: Tomas Halman <thalman@redhat.com>
Date: Mon, 6 May 2024 18:05:46 +0200
Subject: [PATCH] Fix findings from static application security testing

Resource leak in user.c

Resolves: RHEL-35693
---
 0004-resource-leak.patch | 53 ++++++++++++++++++++++++++++++++++++++++
 libuser.spec             |  7 +++++-
 2 files changed, 59 insertions(+), 1 deletion(-)
 create mode 100644 0004-resource-leak.patch

diff --git a/0004-resource-leak.patch b/0004-resource-leak.patch
new file mode 100644
index 0000000..f8c1e00
--- /dev/null
+++ b/0004-resource-leak.patch
@@ -0,0 +1,53 @@
+commit 009d9238317d152f524ee46c4be1ad2f93c47732
+Author: Jakub Hrozek <jakub.hrozek@posteo.se>
+Date:   Wed Sep 26 21:29:35 2018 +0200
+
+    lu_dispatch: Free tmp on failures
+    
+    Merges:
+    https://pagure.io/libuser/issue/23
+    
+    This makes the code slightly less compact with using an explicit
+    condition instead of the g_return_val_if_fail() shorthand, but freeing
+    tmp on failures.
+
+diff --git a/lib/user.c b/lib/user.c
+index ad2bb09..5709f41 100644
+--- a/lib/user.c
++++ b/lib/user.c
+@@ -980,7 +980,10 @@ lu_dispatch(struct lu_context *context,
+ 	case user_default:
+ 	case group_default:
+ 		/* Make sure we have both name and boolean here. */
+-		g_return_val_if_fail(sdata != NULL, FALSE);
++		if (sdata == NULL) {
++			free(tmp);
++			return FALSE;
++		}
+ 		/* Run the checks and preps. */
+ 		if (run_list(context, context->create_module_names,
+ 			    logic_and, id,
+@@ -1059,7 +1062,10 @@ lu_dispatch(struct lu_context *context,
+ 	case user_setpass:
+ 	case group_setpass:
+ 		/* Make sure we have a valid password. */
+-		g_return_val_if_fail(sdata != NULL, FALSE);
++		if (sdata == NULL) {
++			free(tmp);
++			return FALSE;
++		}
+ 		/* no break: fall through */
+ 	case user_removepass:
+ 	case group_removepass:
+@@ -1088,7 +1094,10 @@ lu_dispatch(struct lu_context *context,
+ 	case users_enumerate_by_group:
+ 	case groups_enumerate_by_user:
+ 		/* Make sure we have both name and ID here. */
+-		g_return_val_if_fail(sdata != NULL, FALSE);
++		if (sdata == NULL) {
++			free(tmp);
++			return FALSE;
++		}
+ 		if (id == users_enumerate_by_group)
+ 			ldata = convert_group_name_to_id(context, sdata,
+ 							 error);
diff --git a/libuser.spec b/libuser.spec
index 3554384..c2d6db1 100644
--- a/libuser.spec
+++ b/libuser.spec
@@ -1,12 +1,13 @@
 Name: libuser
 Version: 0.63
-Release: 13%{?dist}
+Release: 14%{?dist}
 License: LGPLv2+
 URL: https://pagure.io/libuser
 Source: http://releases.pagure.org/libuser/libuser-%{version}.tar.xz
 Patch0001: 0001-man-typo.patch
 Patch0002: 0002-popt-memopy.patch
 Patch0003: 0003-translation.patch
+Patch0004: 0004-resource-leak.patch
 
 BuildRequires: glib2-devel
 BuildRequires: linuxdoc-tools
@@ -121,6 +122,10 @@ make
 %{_datadir}/gtk-doc/html/*
 
 %changelog
+* Mon May 6 2024 Tomas Halman <thalman@redhat.com> - 0.63-14
+- Fix findings from static application security testing
+  Resolves: RHEL-35693
+
 * Tue Jul 11 2023 Tomas Halman <thalman@redhat.com> - 0.63-13
 - Translation update
   Resolves: rhbz#2139662