Bug 888728

Summary:	polkitd: memory leak in process_policy_file()
Product:	[Fedora] Fedora	Reporter:	Florian Weimer <fweimer>
Component:	polkit	Assignee:	Miloslav Trmač <mitr>
Status:	CLOSED UPSTREAM	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	18	CC:	mclasen
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-04-13 01:29:05 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	888729

Description Florian Weimer 2012-12-19 10:55:42 UTC

In src/polkitbackend/polkitbackendactionpool.c, function process_policy_file(), there is this code:

  pd.parser = XML_ParserCreate_MM (NULL, NULL, NULL);
  pd.parser = XML_ParserCreate (NULL);

I think this leaks the parser allocated by XML_ParserCreate_MM().

The parser runs with entity expansion enabled, but this doesn't appear to be a problem because the input file is trusted.

Comment 1 Fedora Admin XMLRPC Client 2013-02-01 23:59:39 UTC

This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.

Comment 2 Miloslav Trmač 2013-04-13 01:29:05 UTC

Thanks for your report.  Fix filed upstream at https://bugs.freedesktop.org/show_bug.cgi?id=63492 .  This can only be triggered by the system administrator manipulating /usr/share/polkit-1/actions, so not a vulnerability, and we'll get the fix on next upstream release (which is probably soon).