Vendor import of pkgconf 2.9.93vendor/pkgconf/2.9.93vendor/pkgconf

Obtained from https://github.com/pkgconf/pkgconf/archive/refs/tags/pkgconf-2.9.93.tar.gz

SHA1: 6bcbedc97081e17ea58e0164adea2ab827acfe23  -
SHA256: b9632d0d91321f56645de720fd8cd3584b0d0ca8ff13a3d9d5285888869fcc98  -
SHA512: e014096f5486b7cdfa8c6410992b9143b63c7ef0ba540c7cad09923867c3924b951c1dfbd9a85f6d786b0deb30be1b7284f67317f4b261b6e0eca70b20ace1af  -

One test folder in tests/lib1 had to be removed to avoid UTF-8 filenames
in the tree. (Breaks `make create-source-packages`)

Reviewed by:	markj
Sponsored by:   The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D57890

1 files changed, 39 insertions, 10 deletions

diff --git a/cli/spdxtool/software.c b/cli/spdxtool/software.c
index ac76cf73e7de..c95ec84cbdfa 100644
--- a/cli/spdxtool/software.c
+++ b/cli/spdxtool/software.c
@@ -137,6 +137,10 @@ spdxtool_software_sbom_to_object(pkgconf_client_t *client, spdxtool_software_sbo
 		pkgconf_pkg_t *match = dep->match;
 		pkgconf_buffer_t relationship_buf = PKGCONF_BUFFER_INITIALIZER;
 
+		/* an unresolved (but tolerated) dependency has no match */
+		if (match == NULL)
+			continue;
+
 		pkgconf_buffer_append_fmt(&relationship_buf, "%s%cdependsOn%c%s", sbom->rootElement->id, sep, sep, match->id);
 		char *relationship_str = pkgconf_buffer_freeze(&relationship_buf);
 		if (!relationship_str)
@@ -168,6 +172,10 @@ spdxtool_software_sbom_to_object(pkgconf_client_t *client, spdxtool_software_sbo
 		pkgconf_pkg_t *match = dep->match;
 		pkgconf_buffer_t relationship_buf = PKGCONF_BUFFER_INITIALIZER;
 
+		/* an unresolved (but tolerated) dependency has no match */
+		if (match == NULL)
+			continue;
+
 		pkgconf_buffer_append_fmt(&relationship_buf, "%s%cdependsOn%c%s", sbom->rootElement->id, sep, sep, match->id);
 		char *relationship_str = pkgconf_buffer_freeze(&relationship_buf);
 		if (!relationship_str)
@@ -236,17 +244,24 @@ spdxtool_software_sbom_to_object(pkgconf_client_t *client, spdxtool_software_sbo
 		goto err;
 	}
 
-	if (!spdxtool_serialize_object_add_array(object_list, "software_sbomType", sbom_type_array))
-		goto err;
+	/* object_add_array always takes ownership of the array (it is freed even on
+	 * failure), so clear our reference before checking the result to avoid a
+	 * double free at the error label.
+	 */
+	bool ok = spdxtool_serialize_object_add_array(object_list, "software_sbomType", sbom_type_array);
 	sbom_type_array = NULL;
-
-	if (!spdxtool_serialize_object_add_array(object_list, "rootElement", root_element_array))
+	if (!ok)
 		goto err;
-	root_element_array = NULL;
 
-	if (!spdxtool_serialize_object_add_array(object_list, "element", element_array))
+	ok = spdxtool_serialize_object_add_array(object_list, "rootElement", root_element_array);
+	root_element_array = NULL;
+	if (!ok)
 		goto err;
+
+	ok = spdxtool_serialize_object_add_array(object_list, "element", element_array);
 	element_array = NULL;
+	if (!ok)
+		goto err;
 
 	if (!spdxtool_core_spdx_document_add_package(client, sbom->spdx_document, sbom->rootElement))
 		goto err;
@@ -343,9 +358,14 @@ spdxtool_software_package_to_object(pkgconf_client_t *client, pkgconf_pkg_t *pkg
 		goto err;
 	}
 
-	if (!spdxtool_serialize_object_add_array(object_list, "originatedBy", originated_by))
-		goto err;
+	/* object_add_array always takes ownership of the array (it is freed even on
+	 * failure), so clear our reference before checking the result to avoid a
+	 * double free at the error label.
+	 */
+	bool ok = spdxtool_serialize_object_add_array(object_list, "originatedBy", originated_by);
 	originated_by = NULL;
+	if (!ok)
+		goto err;
 
 	supplier = spdxtool_util_tuple_lookup(client, &pkg->vars, "suppliedBy");
 	if (supplier)
@@ -357,9 +377,10 @@ spdxtool_software_package_to_object(pkgconf_client_t *client, pkgconf_pkg_t *pkg
 		if (!spdxtool_serialize_array_add_string(supplied_by, supplier))
 			goto err;
 
-		if (!spdxtool_serialize_object_add_array(object_list, "suppliedBy", supplied_by))
-			goto err;
+		ok = spdxtool_serialize_object_add_array(object_list, "suppliedBy", supplied_by);
 		supplied_by = NULL;
+		if (!ok)
+			goto err;
 	}
 
 	if (!serialize_copyright_lines_to_object(object_list, &pkg->copyright))
@@ -442,6 +463,10 @@ spdxtool_software_package_to_object(pkgconf_client_t *client, pkgconf_pkg_t *pkg
 		pkgconf_pkg_t *match = dep->match;
 		pkgconf_buffer_t relationship_buf = PKGCONF_BUFFER_INITIALIZER;
 
+		/* an unresolved (but tolerated) dependency has no match */
+		if (match == NULL)
+			continue;
+
 		pkgconf_buffer_append_fmt(&relationship_buf, "%s%cdependsOn%c%s", pkg->id, sep, sep, match->id);
 		char *relationship_str = pkgconf_buffer_freeze(&relationship_buf);
 		if (!relationship_str)
@@ -484,6 +509,10 @@ spdxtool_software_package_to_object(pkgconf_client_t *client, pkgconf_pkg_t *pkg
 		pkgconf_pkg_t *match = dep->match;
 		pkgconf_buffer_t relationship_buf = PKGCONF_BUFFER_INITIALIZER;
 
+		/* an unresolved (but tolerated) dependency has no match */
+		if (match == NULL)
+			continue;
+
 		pkgconf_buffer_append_fmt(&relationship_buf, "%s%cdependsOn%c%s", pkg->id, sep, sep, match->id);
 		char *relationship_str = pkgconf_buffer_freeze(&relationship_buf);
 		if (!relationship_str)