Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package wget for openSUSE:Factory checked in at 2026-08-15 22:40:05 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/wget (Old) and /work/SRC/openSUSE:Factory/.wget.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "wget" Sat Aug 15 22:40:05 2026 rev:78 rq:1370956 version:1.25.0 Changes: -------- --- /work/SRC/openSUSE:Factory/wget/wget.changes 2026-07-23 23:10:28.008548879 +0200 +++ /work/SRC/openSUSE:Factory/.wget.new.1258/wget.changes 2026-08-15 22:40:08.921578006 +0200 @@ -1,0 +2,6 @@ +Wed Aug 12 14:05:01 UTC 2026 - Valentin Lefebvre <[email protected]> + +- Fix segmentation fault in metalink4, bsc#1273449 + * Fix-segfault-in-retrieve_from_metalink-when-a-metalink.patch + +------------------------------------------------------------------- New: ---- Fix-segfault-in-retrieve_from_metalink-when-a-metalink.patch ----------(New B)---------- New:- Fix segmentation fault in metalink4, bsc#1273449 * Fix-segfault-in-retrieve_from_metalink-when-a-metalink.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ wget.spec ++++++ --- /var/tmp/diff_new_pack.fnv9AL/_old 2026-08-15 22:40:09.930613524 +0200 +++ /var/tmp/diff_new_pack.fnv9AL/_new 2026-08-15 22:40:09.936613735 +0200 @@ -46,6 +46,8 @@ Patch9: CVE-2026-58472.patch #PATCH-FIX-UPSTREAM commit 4f85853f641863d5915786a8413e1a213726a62b Patch10: CVE-2026-15146.patch +#PATCH-FIX-UPSTREAM commit aaf77cb98e4c7ba4d775923444e5f0d93ae0e5d3 +Patch11: Fix-segfault-in-retrieve_from_metalink-when-a-metalink.patch BuildRequires: makeinfo BuildRequires: pkgconfig >= 0.9.0 BuildRequires: pkgconfig(gpgme) >= 0.4.2 ++++++ Fix-segfault-in-retrieve_from_metalink-when-a-metalink.patch ++++++ >From aaf77cb98e4c7ba4d775923444e5f0d93ae0e5d3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tim=20R=C3=BChsen?= <[email protected]> Date: Mon, 10 Aug 2026 17:21:30 +0200 Subject: [PATCH] Fix segfault in retrieve_from_metalink() when a metalink:file has no resources * src/main.c (main): Guard access to mfile->resources. * src/metalink.c (retrieve_from_metalink): Likewise. Reported-by: vlefebvre <[email protected]> Co-authored-by: vlefebvre <[email protected]> --- src/main.c | 20 ++++++++++++-------- src/metalink.c | 28 +++++++++++++++++++--------- 2 files changed, 31 insertions(+), 17 deletions(-) diff --git a/src/main.c b/src/main.c index 3926f501..bf4aed04 100644 --- a/src/main.c +++ b/src/main.c @@ -2224,17 +2224,21 @@ only if outputting to a regular file.\n")); metalink_file_t **mfile_ptr; for (mfile_ptr = metalink->files; *mfile_ptr; mfile_ptr++) { - metalink_resource_t **mres_ptr; metalink_file_t *mfile = *mfile_ptr; - size_t mres_count = 0; - for (mres_ptr = mfile->resources; *mres_ptr; mres_ptr++) - mres_count++; + if (mfile->resources) + { + metalink_resource_t **mres_ptr; + size_t mres_count = 0; - stable_sort (mfile->resources, - mres_count, - sizeof (metalink_resource_t *), - metalink_res_cmp); + for (mres_ptr = mfile->resources; *mres_ptr; mres_ptr++) + mres_count++; + + stable_sort (mfile->resources, + mres_count, + sizeof (metalink_resource_t *), + metalink_res_cmp); + } } } retr_err = retrieve_from_metalink (metalink); diff --git a/src/metalink.c b/src/metalink.c index 954546d2..4c228eb2 100644 --- a/src/metalink.c +++ b/src/metalink.c @@ -300,17 +300,21 @@ retrieve_from_metalink (const metalink_t* metalink) metalink_file_t **x_mfile_ptr; for (x_mfile_ptr = metaurl_xml->files; *x_mfile_ptr; x_mfile_ptr++) { - metalink_resource_t **x_mres_ptr; metalink_file_t *x_mfile = *x_mfile_ptr; - size_t mres_count = 0; - for (x_mres_ptr = x_mfile->resources; *x_mres_ptr; x_mres_ptr++) - mres_count++; + if (x_mfile->resources) + { + metalink_resource_t **x_mres_ptr; + size_t mres_count = 0; - stable_sort (x_mfile->resources, - mres_count, - sizeof (metalink_resource_t *), - metalink_res_cmp); + for (x_mres_ptr = x_mfile->resources; *x_mres_ptr; x_mres_ptr++) + mres_count++; + + stable_sort (x_mfile->resources, + mres_count, + sizeof (metalink_resource_t *), + metalink_res_cmp); + } } } @@ -370,7 +374,7 @@ retrieve_from_metalink (const metalink_t* metalink) /* Resources are sorted by priority. */ for (mres_ptr = mfile->resources; - *mres_ptr && mfile->checksums && !skip_mfile; mres_ptr++) + mres_ptr && *mres_ptr && mfile->checksums && !skip_mfile; mres_ptr++) { metalink_resource_t *mres = *mres_ptr; metalink_checksum_t **mchksum_ptr, *mchksum; @@ -859,6 +863,12 @@ gpg_skip_verification: } /* endif RETR_OK. */ } /* Iterate over resources. */ + if (!mfile->resources) + { + logprintf (LOG_NOTQUIET, _("No resources found.\n")); + retr_err = METALINK_MISSING_RESOURCE; + } + if (!mfile->checksums) { logprintf (LOG_NOTQUIET, _("No checksums found.\n")); -- 2.55.0
