From d489081441d3f4ad51a028618ebeae6bcc6de48b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Fri, 11 Mar 2011 13:02:13 +0100
Subject: [PATCH] Fix ddquot buffer leak

https://sourceforge.net/tracker/?func=detail&aid=3206267&group_id=18136&atid=118136
---
 quota-4.00_pre1-Fix-ddquot-buffer-leak.patch | 41 ++++++++++++++++++++
 quota.spec                                   |  9 ++++-
 2 files changed, 49 insertions(+), 1 deletion(-)
 create mode 100644 quota-4.00_pre1-Fix-ddquot-buffer-leak.patch

diff --git a/quota-4.00_pre1-Fix-ddquot-buffer-leak.patch b/quota-4.00_pre1-Fix-ddquot-buffer-leak.patch
new file mode 100644
index 0000000..04d1350
--- /dev/null
+++ b/quota-4.00_pre1-Fix-ddquot-buffer-leak.patch
@@ -0,0 +1,41 @@
+From 797913a0c470da93d44201d074d343953a38589c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
+Date: Fri, 11 Mar 2011 11:06:20 +0100
+Subject: [PATCH] Fix ddquot buffer leak
+
+The ddquot buffer is used to tranfer data from/to file. All its data are
+copied from/to it, so it's not needed after return from qtree_read_dquot()/
+qtree_write_dquot().
+---
+ quotaio_tree.c |    3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/quotaio_tree.c b/quotaio_tree.c
+index cdc0e8f..9f87889 100644
+--- a/quotaio_tree.c
++++ b/quotaio_tree.c
+@@ -272,6 +272,7 @@ void qtree_write_dquot(struct dquot *dquot)
+ 	lseek(dquot->dq_h->qh_fd, dquot->dq_dqb.u.v2_mdqb.dqb_off, SEEK_SET);
+ 	info->dqi_ops->mem2disk_dqblk(ddquot, dquot);
+ 	ret = write(dquot->dq_h->qh_fd, ddquot, info->dqi_entry_size);
++	free(ddquot);
+ 	if (ret != info->dqi_entry_size) {
+ 		if (ret > 0)
+ 			errno = ENOSPC;
+@@ -421,11 +422,13 @@ struct dquot *qtree_read_dquot(struct quota_handle *h, qid_t id)
+ 		if (ret != info->dqi_entry_size) {
+ 			if (ret > 0)
+ 				errno = EIO;
++			free(ddquot);
+ 			die(2, _("Cannot read quota structure for id %u: %s\n"), dquot->dq_id,
+ 			    strerror(errno));
+ 		}
+ 		info->dqi_ops->disk2mem_dqblk(dquot, ddquot);
+ 	}
++	free(ddquot);
+ 	return dquot;
+ }
+ 
+-- 
+1.7.4
+
diff --git a/quota.spec b/quota.spec
index b4cfd50..0af8863 100644
--- a/quota.spec
+++ b/quota.spec
@@ -5,7 +5,7 @@ Name: quota
 Summary: System administration tools for monitoring users' disk usage
 Epoch: 1
 Version: 4.00
-Release: 0.11.pre1%{?dist}
+Release: 0.12.pre1%{?dist}
 License: BSD and GPLv2+
 URL: http://sourceforge.net/projects/linuxquota/
 Group: System Environment/Base
@@ -72,6 +72,9 @@ Patch26: quota-4.00_pre1-Fix-synopsis-and-properly-report-errors-during-remot.pa
 Patch27: quota-4.00_pre1-Forbid-grace-time-setting-over-RPC.patch
 # Submitted to upstream, SF#3202953
 Patch28: quota-4.00_pre1-Reverse-setgrace-condition.patch
+# Submitted to upstream, SF#3206267
+Patch29: quota-4.00_pre1-Fix-ddquot-buffer-leak.patch
+
 
 %description
 The quota package contains system administration tools for monitoring
@@ -170,6 +173,7 @@ Linux/UNIX environment.
 %patch26 -p1 -b .fix_grace_synopsis
 %patch27 -p1 -b .forbid_rpc_grace_time
 %patch28 -p1 -b .reverse_setgrace_condition
+%patch29 -p1 -b .fix_ddquot_leak
 # quotactl(2) moved into `man-pages' package (bug #640590)
 rm -f quotactl.2
 # remove VCS files
@@ -292,6 +296,9 @@ rm -rf %{buildroot}
 
 
 %changelog
+* Fri Mar 11 2011 Petr Pisar <ppisar@redhat.com> - 1:4.00-0.12.pre1
+- Fix ddquot buffer leak
+
 * Thu Mar 10 2011 Petr Pisar <ppisar@redhat.com> - 1:4.00-0.11.pre1
 - Disable grace period/times remote setting