[Bug 1838890] Re: Suspected memory leak in xenial backport of fix for CVE-2019-13012

[Launchpad Bug Tracker]

This bug was fixed in the package glib2.0 - 2.32.4-0ubuntu1.4

---------------
glib2.0 (2.32.4-0ubuntu1.4) precise-security; urgency=medium

  * SECURITY REGRESSION: regression in last security update (LP: #1838890)
    - debian/patches/CVE-2019-13012-regression.patch: fix a
      memory leak introduced by the last security update while
      not properly handled the g_file_get_patch function in
      gio/gkeyfilesettingsbackend.c.

 -- leo.barbosa at canonical.com (Leonidas S. Barbosa)  Mon, 05 Aug 2019
12:54:19 -0300

** Changed in: glib2.0 (Ubuntu Precise)
       Status: In Progress => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to glib2.0 in Ubuntu.
https://bugs.launchpad.net/bugs/1838890

Title:
  Suspected memory leak in xenial backport of fix for CVE-2019-13012

Status in glib2.0 package in Ubuntu:
  In Progress
Status in glib2.0 source package in Precise:
  Fix Released
Status in glib2.0 source package in Trusty:
  In Progress
Status in glib2.0 source package in Xenial:
  Fix Released

Bug description:
  (This is only from source code inspection, not tested in real use - I
  don't actually use Ubuntu.)

  The upstream fix for CVE-2019-13012 included this change:

  -  g_file_make_directory_with_parents (kfsb->dir, NULL, NULL);
  +  g_mkdir_with_parents (g_file_peek_path (kfsb->dir), 0700);

  However, g_file_peek_path() was only introduced in GLib 2.56. The
  backport in the xenial package has this instead:

  -  g_file_make_directory_with_parents (kfsb->dir, NULL, NULL);
  +  g_mkdir_with_parents (g_file_get_path (kfsb->dir), 0700);

  This is not equivalent. The difference between g_file_peek_path() and
  the older g_file_get_path() is that g_file_get_path() makes a copy,
  which must be freed with g_free() after use. As a result, there is now
  a memory leak.

  A non-leaky backport would look something like this, which is what
  I've done in a proposed backport for Debian 9 'stretch':

  + char *dir;
  ...
  -  g_file_make_directory_with_parents (kfsb->dir, NULL, NULL);
  +  dir = g_file_get_path (kfsb->dir);
  +  g_mkdir_with_parents (dir, 0700);
  +  g_free (dir);

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/glib2.0/+bug/1838890/+subscriptions