Fixed memory leak easily triggered by cvsps on large repos (like gentoo-x86).

(Portage version: 2.2.0_alpha149_p86/cvs/Linux x86_64, signed Manifest commit with key 611FF3AA)

5 files changed, 425 insertions, 3 deletions

diff --git a/dev-vcs/cvs/ChangeLog b/dev-vcs/cvs/ChangeLog
index 5f34e8d602bc..a46b68191b15 100644
--- a/dev-vcs/cvs/ChangeLog
+++ b/dev-vcs/cvs/ChangeLog
@@ -1,6 +1,15 @@
 # ChangeLog for dev-vcs/cvs
-# Copyright 1999-2012 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/dev-vcs/cvs/ChangeLog,v 1.7 2012/06/09 07:10:57 vapier Exp $
+# Copyright 1999-2013 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/dev-vcs/cvs/ChangeLog,v 1.8 2013/01/11 13:47:04 slyfox Exp $
+
+*cvs-1.12.13-r2 (11 Jan 2013)
+*cvs-1.12.13.1-r1 (11 Jan 2013)
+*cvs-1.12.12-r10 (11 Jan 2013)
+
+  11 Jan 2013; Sergei Trofimovich <slyfox@gentoo.org> +cvs-1.12.12-r10.ebuild,
+  +cvs-1.12.13-r2.ebuild, +cvs-1.12.13.1-r1.ebuild,
+  +files/cvs-1.12.12-fix-massive-leak.patch:
+  Fixed memory leak easily triggered by cvsps on large repos (like gentoo-x86).
 
   09 Jun 2012; Mike Frysinger <vapier@gentoo.org>
   +files/cvs-1.12.12-mktime-x32.patch, cvs-1.12.12-r6.ebuild,
@@ -607,4 +616,3 @@
 
   16 Mar 2002; Bruce A. Locke <blocke@shivan.org> cvs-1.11.1_p1.ebuild : Update
   to cvs 1.11.1p1 with Redhat's external zlib linking patch
-
diff --git a/dev-vcs/cvs/cvs-1.12.12-r10.ebuild b/dev-vcs/cvs/cvs-1.12.12-r10.ebuild
new file mode 100644
index 000000000000..5e4131060683
--- /dev/null
+++ b/dev-vcs/cvs/cvs-1.12.12-r10.ebuild
@@ -0,0 +1,88 @@
+# Copyright 1999-2013 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/dev-vcs/cvs/cvs-1.12.12-r10.ebuild,v 1.1 2013/01/11 13:47:04 slyfox Exp $
+
+EAPI=3
+
+inherit eutils pam
+
+DESCRIPTION="Concurrent Versions System - source code revision control tools"
+HOMEPAGE="http://www.nongnu.org/cvs/"
+
+SRC_URI="mirror://gnu/non-gnu/cvs/source/feature/${PV}/${P}.tar.bz2
+	doc? ( mirror://gnu/non-gnu/cvs/source/feature/${PV}/cederqvist-${PV}.html.tar.bz2
+		mirror://gnu/non-gnu/cvs/source/feature/${PV}/cederqvist-${PV}.pdf
+		mirror://gnu/non-gnu/cvs/source/feature/${PV}/cederqvist-${PV}.ps )"
+
+LICENSE="GPL-2 LGPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+
+IUSE="crypt doc kerberos nls pam server"
+
+DEPEND=">=sys-libs/zlib-1.1.4
+	kerberos? ( virtual/krb5 )
+	pam? ( virtual/pam )"
+
+src_unpack() {
+	unpack ${P}.tar.bz2
+	use doc && unpack cederqvist-${PV}.html.tar.bz2
+}
+
+src_prepare() {
+	epatch "${FILESDIR}"/${P}-cvsbug-tmpfix.patch
+	epatch "${FILESDIR}"/${P}-openat.patch
+	epatch "${FILESDIR}"/${P}-block-requests.patch
+	epatch "${FILESDIR}"/${P}-cvs-gnulib-vasnprintf.patch
+	epatch "${FILESDIR}"/${P}-install-sh.patch
+	epatch "${FILESDIR}"/${P}-hash-nameclash.patch # for AIX
+	epatch "${FILESDIR}"/${P}-getdelim.patch # 314791
+	epatch "${FILESDIR}"/${PN}-1.12.12-rcs2log-coreutils.patch # 144114
+	epatch "${FILESDIR}"/${P}-mktime-x32.patch # 395641
+	epatch "${FILESDIR}"/${P}-fix-massive-leak.patch
+	use server || elog "If you want any CVS server functionality, you MUST emerge with USE=server!"
+}
+
+src_configure() {
+	econf \
+		--with-external-zlib \
+		--with-tmpdir=/tmp \
+		$(use_enable crypt encryption) \
+		$(use_with kerberos gssapi) \
+		$(use_enable nls) \
+		$(use_enable pam) \
+		$(use_enable server)
+}
+
+src_install() {
+	emake install DESTDIR="${D}" || die
+
+	insinto /etc/xinetd.d
+	if use server; then
+		newins "${FILESDIR}"/cvspserver.xinetd.d cvspserver || die "newins failed"
+	fi
+	newenvd "${FILESDIR}"/01-cvs-env.d 01cvs
+
+	dodoc BUGS ChangeLog* DEVEL* FAQ HACKING \
+		MINOR* NEWS PROJECTS README* TESTS TODO
+
+	# Not installed into emacs site-lisp because it clobbers the normal C
+	# indentations.
+	dodoc cvs-format.el || die "dodoc failed"
+
+	use server && newdoc "${FILESDIR}"/cvs-1.12.12-cvs-custom.c cvs-custom.c
+
+	if use doc; then
+		dodoc "${DISTDIR}"/cederqvist-${PV}.pdf
+		dodoc "${DISTDIR}"/cederqvist-${PV}.ps
+		tar xjf "${DISTDIR}"/cederqvist-${PV}.html.tar.bz2
+		dohtml -r cederqvist-${PV}.html/*
+		dosym cvs.html /usr/share/doc/${PF}/html/index.html
+	fi
+
+	newpamd "${FILESDIR}"/cvs.pam-include-1.12.12 cvs
+}
+
+src_test() {
+	einfo "FEATURES=\"maketest\" has been disabled for dev-vcs/cvs"
+}
diff --git a/dev-vcs/cvs/cvs-1.12.13-r2.ebuild b/dev-vcs/cvs/cvs-1.12.13-r2.ebuild
new file mode 100644
index 000000000000..c16c9ba44f85
--- /dev/null
+++ b/dev-vcs/cvs/cvs-1.12.13-r2.ebuild
@@ -0,0 +1,127 @@
+# Copyright 1999-2013 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/dev-vcs/cvs/cvs-1.12.13-r2.ebuild,v 1.1 2013/01/11 13:47:04 slyfox Exp $
+
+EAPI=3
+
+inherit eutils pam
+
+DESCRIPTION="Concurrent Versions System - source code revision control tools"
+HOMEPAGE="http://www.nongnu.org/cvs/"
+
+SRC_URI="mirror://gnu/non-gnu/cvs/source/feature/${PV}/${P}.tar.bz2
+	doc? ( mirror://gnu/non-gnu/cvs/source/feature/${PV}/cederqvist-${PV}.html.tar.bz2
+		mirror://gnu/non-gnu/cvs/source/feature/${PV}/cederqvist-${PV}.pdf
+		mirror://gnu/non-gnu/cvs/source/feature/${PV}/cederqvist-${PV}.ps )"
+
+LICENSE="GPL-2 LGPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~sparc-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+
+IUSE="crypt doc emacs kerberos nls pam server"
+
+DEPEND=">=sys-libs/zlib-1.1.4
+		kerberos? ( virtual/krb5 )
+		pam? ( virtual/pam )"
+
+src_unpack() {
+	unpack ${P}.tar.bz2
+	use doc && unpack cederqvist-${PV}.html.tar.bz2
+}
+
+src_prepare() {
+	epatch "${FILESDIR}"/${PN}-1.12.12-cvsbug-tmpfix.patch
+	epatch "${FILESDIR}"/${P}-openat.patch
+	epatch "${FILESDIR}"/${P}-zlib.patch
+	epatch "${FILESDIR}"/${PN}-1.12.12-install-sh.patch
+	epatch "${FILESDIR}"/${PN}-1.12.12-fix-massive-leak.patch
+	# this testcase was not updated
+	#sed -i.orig -e '/unrecognized keyword.*BogusOption/s,98,73,g' \
+	#  ${S}/src/sanity.sh
+	# this one fails when the testpath path contains '.'
+	sed -i.orig -e '/newfile config3/s,a-z,a-z.,g' \
+	  "${S}"/src/sanity.sh
+}
+
+src_configure() {
+	local myconf
+	# the tests need the server and proxy
+	if has test $FEATURES; then
+		use server || \
+		ewarn "The server and proxy code are enabled as they are required for tests."
+		myconf="--enable-server --enable-proxy"
+	fi
+	econf \
+		--with-external-zlib \
+		--with-tmpdir=/tmp \
+		$(use_enable crypt encryption) \
+		$(use_with kerberos gssapi) \
+		$(use_enable nls) \
+		$(use_enable pam) \
+		$(use_enable server) \
+		$(use_enable server proxy)
+}
+
+src_install() {
+	einstall || die
+
+	if use server; then
+	  insinto /etc/xinetd.d
+	  newins "${FILESDIR}"/cvspserver.xinetd.d cvspserver || die "newins failed"
+	fi
+
+	dodoc BUGS ChangeLog* DEVEL* FAQ HACKING \
+		MINOR* NEWS PROJECTS README* TESTS TODO
+
+	if use emacs; then
+		insinto /usr/share/emacs/site-lisp
+		doins cvs-format.el || die "doins failed"
+	fi
+
+	if use doc; then
+		dodoc "${DISTDIR}"/cederqvist-${PV}.pdf
+		dodoc "${DISTDIR}"/cederqvist-${PV}.ps
+		tar xjf "${DISTDIR}"/cederqvist-${PV}.html.tar.bz2
+		dohtml -r cederqvist-${PV}.html/*
+		dosym cvs.html /usr/share/doc/${PF}/html/index.html
+	fi
+
+	newpamd "${FILESDIR}"/cvs.pam-include-1.12.12 cvs
+}
+
+src_test() {
+	einfo "If you want to see realtime status, or check out a failure,"
+	einfo "please look at ${S}/src/check.log*"
+	if [ -n "$TEST_REMOTE_AND_PROXY" ]; then
+		einfo "local, remote, and proxy tests enabled."
+	else
+		einfo "Only testing local mode. Please see ebuild for other modes."
+	fi
+
+	cd "${S}"/src
+	export TESTDIR="${T}/tests-local"
+	mkdir -p "$TESTDIR"
+	# we only do the local tests by default
+	make localcheck || die "Some local test failed."
+	mv -f check.log check.log-local
+
+	# if you want to test the remote and proxy modes, things get a little bit
+	# complicated. You need to set up a SSH config file at ~portage/.ssh/config
+	# that allows the portage user to login without any authentication, and also
+	# set up the ~portage/.ssh/known_hosts file for your machine.
+	# We do not do this by default, as it is unsafe from a security point of
+	# view, and requires root level ssh changes.
+	if [ -n "$TEST_REMOTE_AND_PROXY" ]; then
+		cd "${S}"/src
+		export TESTDIR="${T}/tests-remote"
+		mkdir -p "$TESTDIR"
+		make remotecheck || die "Some remote test failed."
+		mv -f check.log check.log-remote
+
+		cd "${S}"/src
+		export TESTDIR="${T}/tests-proxy"
+		mkdir -p "$TESTDIR"
+		make proxycheck || die "Some proxy test failed."
+		mv -f check.log check.log-proxy
+	fi
+}
diff --git a/dev-vcs/cvs/cvs-1.12.13.1-r1.ebuild b/dev-vcs/cvs/cvs-1.12.13.1-r1.ebuild
new file mode 100644
index 000000000000..49ff212f87be
--- /dev/null
+++ b/dev-vcs/cvs/cvs-1.12.13.1-r1.ebuild
@@ -0,0 +1,147 @@
+# Copyright 1999-2013 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/dev-vcs/cvs/cvs-1.12.13.1-r1.ebuild,v 1.1 2013/01/11 13:47:04 slyfox Exp $
+
+EAPI=3
+
+inherit eutils pam versionator
+
+DESCRIPTION="Concurrent Versions System - source code revision control tools"
+HOMEPAGE="http://www.nongnu.org/cvs/"
+
+DOC_PV="$(get_version_component_range 1-3)"
+FEAT_URIBASE="mirror://gnu/non-gnu/cvs/source/feature/${PV}/"
+DOC_URIBASE="mirror://gnu/non-gnu/cvs/source/feature/${DOC_PV}/"
+SNAP_URIBASE="mirror://gnu/non-gnu/cvs/source/nightly-snapshots/feature/"
+SRC_URI="
+	${FEAT_URIBASE}/${P}.tar.bz2
+	${SNAP_URIBASE}/${P}.tar.bz2
+	doc? (
+		${DOC_URIBASE}/cederqvist-${DOC_PV}.html.tar.bz2
+		${DOC_URIBASE}/cederqvist-${DOC_PV}.pdf
+		${DOC_URIBASE}/cederqvist-${DOC_PV}.ps
+		)"
+
+LICENSE="GPL-2 LGPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~sparc-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+
+IUSE="crypt doc kerberos nls pam server"
+
+DEPEND=">=sys-libs/zlib-1.1.4
+		kerberos? ( virtual/krb5 )
+		pam? ( virtual/pam )"
+
+src_unpack() {
+	unpack ${P}.tar.bz2
+	use doc && unpack cederqvist-${DOC_PV}.html.tar.bz2
+}
+
+src_prepare() {
+	epatch "${FILESDIR}"/${PN}-1.12.12-cvsbug-tmpfix.patch
+	epatch "${FILESDIR}"/${PN}-1.12.12-install-sh.patch
+	epatch "${FILESDIR}"/${PN}-1.12.13.1-block-requests.patch
+	epatch "${FILESDIR}"/${PN}-1.12.13.1-hash-nameclash.patch # for AIX
+	epatch "${FILESDIR}"/${PN}-1.12.13.1-gl-mempcpy.patch # for AIX
+	epatch "${FILESDIR}"/${PN}-1.12.12-fix-massive-leak.patch
+	# Applied by upstream:
+	#epatch "${FILESDIR}"/${PN}-1.12.13-openat.patch
+	#epatch "${FILESDIR}"/${PN}-1.12.13-zlib.patch
+
+	# this testcase was not updated
+	#sed -i.orig -e '/unrecognized keyword.*BogusOption/s,98,73,g' \
+	#  ${S}/src/sanity.sh
+	# this one fails when the testpath path contains '.'
+	sed -i.orig \
+		-e '/newfile config3/s,a-z,a-z.,g' \
+		"${S}"/src/sanity.sh
+
+	elog "If you want any CVS server functionality, you MUST emerge with USE=server!"
+}
+
+src_configure() {
+	local myconf
+	# the tests need the server and proxy
+	if has test $FEATURES; then
+		use server || \
+		ewarn "The server and proxy code are enabled as they are required for tests."
+		myconf="--enable-server --enable-proxy"
+	fi
+	econf \
+		--with-external-zlib \
+		--with-tmpdir=/tmp \
+		$(use_enable crypt encryption) \
+		$(use_with kerberos gssapi) \
+		$(use_enable nls) \
+		$(use_enable pam) \
+		$(use_enable server) \
+		$(use_enable server proxy) \
+		${myconf}
+}
+
+src_install() {
+	emake install DESTDIR="${D}" || die
+
+	if use server; then
+	  insinto /etc/xinetd.d
+	  newins "${FILESDIR}"/cvspserver.xinetd.d cvspserver || die "newins failed"
+	fi
+
+	dodoc BUGS ChangeLog* DEVEL* FAQ HACKING \
+		MINOR* NEWS PROJECTS README* TESTS TODO
+
+	# Not installed into emacs site-lisp because it clobbers the normal C
+	# indentations.
+	dodoc cvs-format.el || die "dodoc failed"
+
+	use server && newdoc "${FILESDIR}"/${PN}-1.12.12-cvs-custom.c cvs-custom.c
+
+	if use doc; then
+		dodoc "${DISTDIR}"/cederqvist-${DOC_PV}.pdf
+		dodoc "${DISTDIR}"/cederqvist-${DOC_PV}.ps
+		dohtml -r "${WORKDIR}"/cederqvist-${DOC_PV}.html/
+		dosym cvs.html /usr/share/doc/${PF}/html/index.html
+	fi
+
+	newpamd "${FILESDIR}"/cvs.pam-include-1.12.12 cvs
+}
+
+_run_one_test() {
+	mode="$1" ; shift
+	einfo "Starting ${mode} test"
+	cd "${S}"/src
+	export TESTDIR="${T}/tests-${mode}"
+	rm -rf "$TESTDIR" # Clean up from any previous test passes
+	mkdir -p "$TESTDIR"
+	emake -j1 ${mode}check || die "Some ${mode} test failed."
+	mv -f check.log check.log-${mode}
+	einfo "${mode} test completed successfully, log is check.log-${mode}"
+}
+
+src_test() {
+	einfo "If you want to see realtime status, or check out a failure,"
+	einfo "please look at ${S}/src/check.log*"
+
+	if [ "$TEST_REMOTE_AND_PROXY" == "1" ]; then
+		einfo "local, remote, and proxy tests enabled."
+	else
+		einfo "Only testing local mode. Please see ebuild for other modes."
+	fi
+
+	# we only do the local tests by default
+	_run_one_test local
+
+	# if you want to test the remote and proxy modes, things get a little bit
+	# complicated. You need to set up a SSH config file at ~portage/.ssh/config
+	# that allows the portage user to login without any authentication, and also
+	# set up the ~portage/.ssh/known_hosts file for your machine.
+	# We do not do this by default, as it is unsafe from a security point of
+	# view, and requires root level ssh changes.
+	# Note that this also requires having a real shell for the portage user, so make
+	# sure that su -c 'ssh portage@mybox' portage works first!
+	# (It uses the local ip, not loopback)
+	if [ "$TEST_REMOTE_AND_PROXY" == "1" ]; then
+		_run_one_test remote
+		_run_one_test proxy
+	fi
+}
diff --git a/dev-vcs/cvs/files/cvs-1.12.12-fix-massive-leak.patch b/dev-vcs/cvs/files/cvs-1.12.12-fix-massive-leak.patch
new file mode 100644
index 000000000000..5366f50855f1
--- /dev/null
+++ b/dev-vcs/cvs/files/cvs-1.12.12-fix-massive-leak.patch
@@ -0,0 +1,52 @@
+buf_free_data must free data independently
+of send or reseived bytes over network.
+
+Moreover, when buffer is usually freed
+buffer _is_ empty, but has one clean mapped page.
+
+I've observed massive 'cvs server' leaks
+when importing large gentoo-x86 repo with 'cvsps'.
+Leak ate all my 32GBs of RAM and killed process.
+(Leaked around 3 pages per client request).
+
+valgrind found the leak easily:
+
+$ valgrind \
+    cvsps \
+           --root :local:$HOME/portage/gentoo-x86.rsync \
+           --fast-export \
+           gentoo-x86/dev-vcs/git-annex 2>l |
+    git fast-import
+
+    ==13504== 1,248 bytes in 52 blocks are still reachable in loss record 41 of 47
+    ==13504==    at 0x4C2C19B: malloc (vg_replace_malloc.c:270)
+    ==13504==    by 0x48A556: xnmalloc_inline (xmalloc.c:40)
+    ==13504==    by 0x48A5B5: xmalloc (xmalloc.c:56)
+    ==13504==    by 0x4855F5: new_memnode (pagealign_alloc.c:91)
+    ==13504==    by 0x48571B: pagealign_alloc (pagealign_alloc.c:151)
+    ==13504==    by 0x485739: pagealign_xalloc (pagealign_alloc.c:182)
+    ==13504==    by 0x408DD7: get_buffer_data (buffer.c:98)
+    ==13504==    by 0x409C0C: buf_input_data (buffer.c:738)
+    ==13504==    by 0x45BB63: do_cvs_command (server.c:3847)
+    ==13504==    by 0x45D39E: serve_co (server.c:4809)
+    ==13504==    by 0x45F845: server (server.c:6438)
+    ==13504==    by 0x438784: main (main.c:1066)
+
+And now it takes constant space (less, than 18MB)
+for 'cvs server' process to convert all gentoo-x86
+by serving more, than 5 000 000 client requests.
+
+Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
+diff --git a/src/buffer.c b/src/buffer.c
+index 3f12513..9a7a559 100644
+--- a/src/buffer.c
++++ b/src/buffer.c
+@@ -526,7 +526,7 @@ buf_copy_data (struct buffer *buf, struct buffer_data *data,
+ void
+ buf_free_data (struct buffer *buffer)
+ {
+-    if (buf_empty_p (buffer)) return;
++    if (! buffer->data) return;
+     buf_free_datas (buffer->data, buffer->last);
+     buffer->data = buffer->last = NULL;
+ }