From c9083869ec2a3037e6df4bd86b45c419ba295f8e Mon Sep 17 00:00:00 2001 From: Patrick Griffis Date: Thu, 26 Dec 2024 18:31:42 -0600 Subject: [PATCH] soup_header_parse_quality_list: Fix leak When iterating over the parsed list we now steal the allocated strings that we want and then free_full the list which may contain remaining strings. Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/c9083869ec2a3037e6df4bd86b45c419ba295f8e] CVE: CVE-2025-46420 Signed-off-by: Ashish Sharma libsoup/soup-headers.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c index a5f7a7f6..85385cea 100644 --- a/libsoup/soup-headers.c +++ b/libsoup/soup-headers.c @@ -530,7 +530,7 @@ soup_header_parse_quality_list (const char *header, GSList **unacceptable) GSList *unsorted; QualityItem *array; GSList *sorted, *iter; - char *item, *semi; + char *semi; const char *param, *equal, *value; double qval; int n; @@ -543,9 +543,8 @@ soup_header_parse_quality_list (const char *header, GSList **unacceptable) unsorted = soup_header_parse_list (header); array = g_new0 (QualityItem, g_slist_length (unsorted)); for (iter = unsorted, n = 0; iter; iter = iter->next) { - item = iter->data; qval = 1.0; - for (semi = strchr (item, ';'); semi; semi = strchr (semi + 1, ';')) { + for (semi = strchr (iter->data, ';'); semi; semi = strchr (semi + 1, ';')) { param = skip_lws (semi + 1); if (*param != 'q') continue; @@ -577,15 +576,15 @@ soup_header_parse_quality_list (const char *header, GSList **unacceptable) if (qval == 0.0) { if (unacceptable) { *unacceptable = g_slist_prepend (*unacceptable, - item); + g_steal_pointer (&iter->data)); } } else { - array[n].item = item; + array[n].item = g_steal_pointer (&iter->data); array[n].qval = qval; n++; } } - g_slist_free (unsorted); + g_slist_free_full (unsorted, g_free); qsort (array, n, sizeof (QualityItem), sort_by_qval); sorted = NULL; -- GitLab