Skip to content

Commit

Permalink
repo: Fix invalid free()
Browse files Browse the repository at this point in the history
Check the solv_read_userdata() return code before creating a unique_ptr
with SolvUserdata.
In case the solv_read_userdata() failed, the solv_free would be called
on unitialized data causing undefined behavior.

Resolves: #1845
  • Loading branch information
m-blaha authored and kontura committed Nov 11, 2024
1 parent 8fbbeb2 commit 0a1c3e5
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions libdnf5/repo/solv_repo.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -84,13 +84,13 @@ bool SolvRepo::can_use_solvfile_cache(solv::Pool & pool, fs::File & solvfile_cac
int dnf_solv_userdata_len_read;

int ret_code = solv_read_userdata(solvfile_cache.get(), &dnf_solv_userdata_read, &dnf_solv_userdata_len_read);
std::unique_ptr<SolvUserdata, decltype(&solv_free)> solv_userdata(
reinterpret_cast<SolvUserdata *>(dnf_solv_userdata_read), &solv_free);
if (ret_code != 0) {
logger.warning(
("Failed to read solv userdata: \"{}\": for: {}"), pool_errstr(*pool), solvfile_cache.get_path().native());
return false;
}
std::unique_ptr<SolvUserdata, decltype(&solv_free)> solv_userdata(
reinterpret_cast<SolvUserdata *>(dnf_solv_userdata_read), &solv_free);

if (dnf_solv_userdata_len_read != SOLV_USERDATA_SIZE) {
logger.warning(
Expand Down

0 comments on commit 0a1c3e5

Please sign in to comment.