File PackageKit-CVE-2024-0217.patch of Package PackageKit.33123

From 64278c9127e3333342b56ead99556161f7e86f79 Mon Sep 17 00:00:00 2001
From: Philip Withnall <pwithnall@endlessos.org>
Date: Wed, 15 Mar 2023 16:28:35 +0000
Subject: [PATCH] pk-transaction: Check that Finished signal is emitted at most
 once
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

While I haven’t seen it being emitted more than once, the transaction
code is quite complex, and it would make things more robust to add a
check to verify this.

Signed-off-by: Philip Withnall <pwithnall@endlessos.org>
---
 src/pk-transaction.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/pk-transaction.c b/src/pk-transaction.c
index 192ef2347..ad53cace1 100644
--- a/src/pk-transaction.c
+++ b/src/pk-transaction.c
@@ -90,6 +90,7 @@ struct PkTransactionPrivate
 	guint			 speed;
 	guint			 download_size_remaining;
 	gboolean		 finished;
+	gboolean		 emitted_finished;
 	gboolean		 allow_cancel;
 	gboolean		 waiting_for_auth;
 	gboolean		 emit_eula_required;
@@ -510,6 +511,9 @@ pk_transaction_finished_emit (PkTransaction *transaction,
 			      PkExitEnum exit_enum,
 			      guint time_ms)
 {
+	g_assert (!transaction->priv->emitted_finished);
+	transaction->priv->emitted_finished = TRUE;
+
 	g_debug ("emitting finished '%s', %i",
 		 pk_exit_enum_to_string (exit_enum),
 		 time_ms);
-- 
2.43.0