From b245193e881912cf730b53ece74c410ef573e292 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Wed, 17 Jul 2024 09:30:59 +0200
Subject: [PATCH 1/1] Fix a memory leak in glob_for_cachedir()

Covscan complains:

    Error: RESOURCE_LEAK (CWE-772): [#def1] [important]
    libdnf-0.73.1/libdnf/hy-iutil.cpp:100:5: alloc_arg: "wordexp" allocates memory that is stored into "word_vector.we_wordv".
    libdnf-0.73.1/libdnf/hy-iutil.cpp:102:9: leaked_storage: Variable "word_vector" going out of scope leaks the storage "word_vector.we_wordv" points to.
    #  100|       if (wordexp(p, &word_vector, 0)) {
    #  101|           g_free(p);
    #  102|->         return ret;
    #  103|       }
    #  104|       for (guint i = 0; i < word_vector.we_wordc; ++i) {

The issue is that Covscan model thinks that word_vector should be
freed after failing wordexp(). glibc's manual does not explain whether
it is or isn't necessary. However, POSIX manual mentions that the
memory is valid on WRDE_NOSPACE (not enough memory) error. Reading
glibc sources confirms that wordexp() on any error except of
WRDE_NOSPACE cleans up and returns original, intact word_vector.

Therefore I recognize the missing wordfree() call as an error and
this patch fixed it.
---
 libdnf/hy-iutil.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libdnf/hy-iutil.cpp b/libdnf/hy-iutil.cpp
index 43314c60..4848c9f7 100644
--- a/libdnf/hy-iutil.cpp
+++ b/libdnf/hy-iutil.cpp
@@ -89,7 +89,7 @@ glob_for_cachedir(char *path)
     if (!g_str_has_suffix(path, "XXXXXX"))
         return ret;
 
-    wordexp_t word_vector;
+    wordexp_t word_vector = {0};
     char *p = g_strdup(path);
     const int len = strlen(p);
     struct stat s;
@@ -98,6 +98,7 @@ glob_for_cachedir(char *path)
     p[len-6] = '*';
     p[len-5] = '\0';
     if (wordexp(p, &word_vector, 0)) {
+        wordfree(&word_vector);
         g_free(p);
         return ret;
     }
-- 
2.25.1