From a5b8a94c751e8501e6af47d7197224e671c36b86 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= Date: Mon, 10 Aug 2026 14:21:12 +0200 Subject: [PATCH 1/3] Harden modulemd_module_add_translation() against null-pointer dereferences When the function checks that a module name of the module and the translations are equal, g_str_equal() functions is called. That function does not handle NULL arguments. While we do not pass modules or translations with NULL names to this private function now, it's better to hardern the function against it. This patch adds more preconditions to modulemd_module_add_translation() in order to prevent passing NULL to g_str_equal(). Again, automated tests are impossible becase Glib test framework fatalizes the preconditions. --- modulemd/modulemd-module.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/modulemd/modulemd-module.c b/modulemd/modulemd-module.c index 66e11e14..2efe5333 100644 --- a/modulemd/modulemd-module.c +++ b/modulemd/modulemd-module.c @@ -767,10 +767,18 @@ modulemd_module_add_translation (ModulemdModule *self, gsize i; ModulemdModuleStream *stream = NULL; ModulemdTranslation *newtrans = NULL; + const gchar * self_module_name = NULL; + const gchar * translation_module_name = NULL; - g_return_if_fail ( - g_str_equal (modulemd_translation_get_module_name (translation), - modulemd_module_get_module_name (self))); + g_return_if_fail ( self != NULL ); + self_module_name = modulemd_module_get_module_name(self); + g_return_if_fail ( self_module_name != NULL ); + + g_return_if_fail ( translation != NULL ); + translation_module_name = modulemd_translation_get_module_name (translation); + g_return_if_fail ( translation_module_name != NULL ); + + g_return_if_fail ( g_str_equal (translation_module_name, self_module_name) ); newtrans = modulemd_translation_copy (translation); From d59efdbf9da922a57787c77614ac13a534cad41b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= Date: Mon, 10 Aug 2026 16:37:10 +0200 Subject: [PATCH 2/3] Harden modulemd_module_add_obsoletes() against null-pointer dereferences When the function checks that a module name of the module and the obsoletes are equal, g_str_equal() functions is called. That function does not handle NULL arguments. While we do not pass modules or obsoletes with NULL names to this private function now, it's better to harden the function against it. This patch adds more preconditions to modulemd_module_add_obsoletes() in order to prevent passing NULL to g_str_equal(). Again, automated tests are impossible becase Glib test framework fatalizes the preconditions. --- modulemd/modulemd-module.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/modulemd/modulemd-module.c b/modulemd/modulemd-module.c index 2efe5333..3af631fd 100644 --- a/modulemd/modulemd-module.c +++ b/modulemd/modulemd-module.c @@ -824,10 +824,18 @@ modulemd_module_add_obsoletes (ModulemdModule *self, ModulemdModuleStream *stream = NULL; ModulemdObsoletes *new_obsoletes = NULL; ModulemdObsoletes *current_obsoletes = NULL; + const gchar * self_module_name = NULL; + const gchar * obsoletes_module_name = NULL; + + g_return_if_fail ( self != NULL ); + self_module_name = modulemd_module_get_module_name(self); + g_return_if_fail ( self_module_name != NULL ); + + g_return_if_fail ( obsoletes != NULL ); + obsoletes_module_name = modulemd_obsoletes_get_module_name (obsoletes); + g_return_if_fail ( obsoletes_module_name != NULL ); - g_return_if_fail ( - g_str_equal (modulemd_obsoletes_get_module_name (obsoletes), - modulemd_module_get_module_name (self))); + g_return_if_fail ( g_str_equal (obsoletes_module_name, self_module_name) ); new_obsoletes = modulemd_obsoletes_copy (obsoletes); From 3539f97326bb8f38227cbad2600cc77129275109 Mon Sep 17 00:00:00 2001 From: Libmodulemd CI Date: Mon, 10 Aug 2026 15:28:55 +0000 Subject: [PATCH 3/3] Code auto-formatting Signed-off-by: Libmodulemd CI --- modulemd/modulemd-module.c | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/modulemd/modulemd-module.c b/modulemd/modulemd-module.c index 3af631fd..67221c6e 100644 --- a/modulemd/modulemd-module.c +++ b/modulemd/modulemd-module.c @@ -767,18 +767,18 @@ modulemd_module_add_translation (ModulemdModule *self, gsize i; ModulemdModuleStream *stream = NULL; ModulemdTranslation *newtrans = NULL; - const gchar * self_module_name = NULL; - const gchar * translation_module_name = NULL; + const gchar *self_module_name = NULL; + const gchar *translation_module_name = NULL; - g_return_if_fail ( self != NULL ); - self_module_name = modulemd_module_get_module_name(self); - g_return_if_fail ( self_module_name != NULL ); + g_return_if_fail (self != NULL); + self_module_name = modulemd_module_get_module_name (self); + g_return_if_fail (self_module_name != NULL); - g_return_if_fail ( translation != NULL ); + g_return_if_fail (translation != NULL); translation_module_name = modulemd_translation_get_module_name (translation); - g_return_if_fail ( translation_module_name != NULL ); + g_return_if_fail (translation_module_name != NULL); - g_return_if_fail ( g_str_equal (translation_module_name, self_module_name) ); + g_return_if_fail (g_str_equal (translation_module_name, self_module_name)); newtrans = modulemd_translation_copy (translation); @@ -824,18 +824,18 @@ modulemd_module_add_obsoletes (ModulemdModule *self, ModulemdModuleStream *stream = NULL; ModulemdObsoletes *new_obsoletes = NULL; ModulemdObsoletes *current_obsoletes = NULL; - const gchar * self_module_name = NULL; - const gchar * obsoletes_module_name = NULL; + const gchar *self_module_name = NULL; + const gchar *obsoletes_module_name = NULL; - g_return_if_fail ( self != NULL ); - self_module_name = modulemd_module_get_module_name(self); - g_return_if_fail ( self_module_name != NULL ); + g_return_if_fail (self != NULL); + self_module_name = modulemd_module_get_module_name (self); + g_return_if_fail (self_module_name != NULL); - g_return_if_fail ( obsoletes != NULL ); + g_return_if_fail (obsoletes != NULL); obsoletes_module_name = modulemd_obsoletes_get_module_name (obsoletes); - g_return_if_fail ( obsoletes_module_name != NULL ); + g_return_if_fail (obsoletes_module_name != NULL); - g_return_if_fail ( g_str_equal (obsoletes_module_name, self_module_name) ); + g_return_if_fail (g_str_equal (obsoletes_module_name, self_module_name)); new_obsoletes = modulemd_obsoletes_copy (obsoletes);