4 changed files with 88 additions and 61 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1 +1 @@
-SOURCES/popt-1.19.tar.gz
+SOURCES/popt-1.18.tar.gz
--- a/.popt.metadata
+++ b/.popt.metadata
@ -1 +1 @@
-75654eebd67791f6c58059d0ac552230d81b09d9 SOURCES/popt-1.19.tar.gz
+0bf05488e151228fce9c0c9601162a9f432f69d9 SOURCES/popt-1.18.tar.gz
--- a/SOURCES/popt-1.18-imp-covscan-fixes.patch
+++ b/SOURCES/popt-1.18-imp-covscan-fixes.patch
@ -0,0 +1,64 @@
+commit 7e60d11c1b046e54378cf79280f4a856741c8749
+Author: Tobias Stoeckmann <tobias@stoeckmann.org>
+Date:   Sat Aug 22 14:09:58 2020 +0200
+
+    Close iconv in case of allocation error
+    
+    If memory allocation in strdup_locale_from_utf8 fails after calling
+    iconv_open, the returned conversion descriptor is not closed.
+
+diff --git a/src/poptint.c b/src/poptint.c
+index 0cec176..3a0919a 100644
+--- a/src/poptint.c
+++ b/src/poptint.c
+@@ -91,8 +91,10 @@ strdup_locale_from_utf8 (char * istr)
+ 	size_t ob = db;
+ 	size_t err;
+ 
+-	if (dstr == NULL)
+	if (dstr == NULL) {
+	    (void) iconv_close(cd);
+ 	    return NULL;
+	}
+ 	err = iconv(cd, NULL, NULL, NULL, NULL);
+ 	while (1) {
+ 	    *pout = '\0';
+commit 70011cc5763dca9a9b57e9539b465e00c9769996
+Author: Michal Domonkos <mdomonko@redhat.com>
+Date:   Mon Jul 19 14:41:03 2021 +0200
+
+    Fix potential mem leak in poptReadConfigFile()
+    
+    While it seems that the actual implementation of poptReadFile()
+    shouldn't allocate the passed buffer (b) if the number of bytes (nb) is
+    zero (see the read(2) call in that function), it's still up to the
+    caller to take care of this resource, so let's just do that by bailing
+    out via "exit" where the freeing happens.
+    
+    Also initialize t to NULL to avoid freeing an undefined pointer.
+    
+    Found by Coverity.
+
+diff --git a/src/poptconfig.c b/src/poptconfig.c
+index 8623ba2..7c52315 100644
+--- a/src/poptconfig.c
+++ b/src/poptconfig.c
+@@ -344,13 +344,15 @@ int poptReadConfigFile(poptContext con, const char * fn)
+     char * b = NULL, *be;
+     size_t nb = 0;
+     const char *se;
+-    char *t, *te;
+    char *t = NULL, *te;
+     int rc;
+ 
+     if ((rc = poptReadFile(fn, &b, &nb, POPT_READFILE_TRIMNEWLINES)) != 0)
+ 	return (errno == ENOENT ? 0 : rc);
+-    if (b == NULL || nb == 0)
+-	return POPT_ERROR_BADCONFIG;
+    if (b == NULL || nb == 0) {
+	rc = POPT_ERROR_BADCONFIG;
+	goto exit;
+    }
+ 
+     if ((t = malloc(nb + 1)) == NULL)
+ 	goto exit;
--- a/SPECS/popt.spec
+++ b/SPECS/popt.spec
@ -1,20 +1,15 @@
-%global ver 1.19
-#%%global snap rc1
-%global srcver %{ver}%{?snap:-%{snap}}
-%global sover 0
+%define ver 1.18
+#define snap rc1
+%define srcver %{ver}%{?snap:-%{snap}}

 Summary:        C library for parsing command line parameters
 Name:           popt
 Version:        %{ver}%{?snap:~%{snap}}
 Release:        8%{?dist}
-# COPYING:      MIT text
-# po/eo.po:     LicenseRef-Fedora-Public-Domain
-# po/fi.po:     MIT AND LicenseRef-Fedora-Public-Domain
-# po/lv.po:     MIT AND LicenseRef-Fedora-Public-Domain
-# popt.3:       MIT ("the X consortium license, see the file COPYING")
-License:        MIT AND LicenseRef-Fedora-Public-Domain
+License:        MIT
 URL:            https://github.com/rpm-software-management/popt/
 Source0:        http://ftp.rpm.org/popt/releases/popt-1.x/%{name}-%{srcver}.tar.gz
+Patch0:         popt-1.18-imp-covscan-fixes.patch
 BuildRequires:  gcc
 BuildRequires:  gettext
 BuildRequires:  make
@ -31,7 +26,6 @@ shell-like rules.

 %package devel
 Summary:        Development files for the popt library
-License:        MIT
 Requires:       %{name}%{?_isa} = %{version}-%{release}, pkgconfig

 %description devel
@ -42,7 +36,6 @@ API documentation of the popt library, too.
 %if 0%{!?_without_static:1}
 %package static
 Summary:        Static library for parsing command line parameters
-License:        MIT
 Requires:       %{name}-devel%{?_isa} = %{version}-%{release}

 %description static
@ -60,18 +53,24 @@ Install it if you need to link statically with libpopt.
 %install
 %make_install

+# Don't install any libtool .la files
+rm -f $RPM_BUILD_ROOT%{_libdir}/libpopt.la
+
 # Multiple popt configurations are possible
 mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/popt.d/

 %find_lang %{name}

 %check
-make check || (cat tests/*.log; exit 1)
+make check
+
+%ldconfig_scriptlets

 %files -f %{name}.lang
 %license COPYING
+%doc CHANGES
 %{_sysconfdir}/popt.d/
-%{_libdir}/libpopt.so.%{sover}*
+%{_libdir}/libpopt.so.*

 %files devel
 %doc README
@ -86,54 +85,18 @@ make check || (cat tests/*.log; exit 1)
 %endif

 %changelog
-* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 1.19-8
- Bump release for October 2024 mass rebuild:
-  Resolves: RHEL-64018
-
-* Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 1.19-7
- Bump release for June 2024 mass rebuild
-
-* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.19-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.19-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Wed Aug 23 2023 Petr Pisar <ppisar@redhat.com> - 1.19-4
- Correct a license tag to "MIT AND LicenseRef-Fedora-Public-Domain"
-
-* Fri Jul 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.19-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Fri Jan 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.19-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Fri Sep 16 2022 Robert Scheck <robert@fedoraproject.org> 1.19-1
- Upgrade to 1.19 (#2127400)
-
-* Wed Aug 24 2022 Panu Matilainen <pmatilai@redhat.com> - 1.19~rc1-4
- Restore the memleak fix now that authselect should be fixed
-
-* Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.19~rc1-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Tue Jun 28 2022 Panu Matilainen <pmatilai@redhat.com> - 1.19~rc1-2
- Temporarily revert a memleak fix due to authselect breakage (#2100287)
-
-* Wed Jun 22 2022 Panu Matilainen <pmatilai@redhat.com> - 1.19~rc1-1
- Rebase to 1.19-rc1 (https://github.com/rpm-software-management/popt/releases/tag/popt-1.19-rc1)
- Remove manual .la cleanup, it's automatic nowadays
- Add a guard against accidental soname changes
+* Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 1.18-8
+- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+  Related: rhbz#1991688

-* Fri Jan 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.18-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+* Tue Jul 20 2021 Michal Domonkos <mdomonko@redhat.com> - 1.18-7
+- Add gating.yaml

-* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.18-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+* Mon Jul 19 2021 Michal Domonkos <mdomonko@redhat.com> - 1.18-6
+- Address important covscan issues (#1938846)

-* Wed Jun 23 2021 Panu Matilainen <pmatilai@redhat.com> - 1.18-5
- Fix test-suite expectation on rawhide
- Dump test-suite logs for post-mortem on failure
+* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 1.18-5
+- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937

 * Sat Mar 06 2021 Robert Scheck <robert@fedoraproject.org> 1.18-4
 - Conditionalize static subpackage during build-time