File libsoup-CVE-2025-46420.patch of Package libsoup.38577

From c9083869ec2a3037e6df4bd86b45c419ba295f8e Mon Sep 17 00:00:00 2001
From: Patrick Griffis <pgriffis@igalia.com>
Date: Thu, 26 Dec 2024 18:31:42 -0600
Subject: [PATCH] soup_header_parse_quality_list: Fix leak

When iterating over the parsed list we now steal the allocated strings that we want and then free_full the list which may contain remaining strings.
---
 libsoup/soup-headers.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c
index a5f7a7f6..85385cea 100644
--- a/libsoup/soup-headers.c
+++ b/libsoup/soup-headers.c
@@ -530,7 +530,7 @@ soup_header_parse_quality_list (const char *header, GSList **unacceptable)
 	GSList *unsorted;
 	QualityItem *array;
 	GSList *sorted, *iter;
-	char *item, *semi;
+	char *semi;
 	const char *param, *equal, *value;
 	double qval;
 	int n;
@@ -543,9 +543,8 @@ soup_header_parse_quality_list (const char *header, GSList **unacceptable)
 	unsorted = soup_header_parse_list (header);
 	array = g_new0 (QualityItem, g_slist_length (unsorted));
 	for (iter = unsorted, n = 0; iter; iter = iter->next) {
-		item = iter->data;
 		qval = 1.0;
-		for (semi = strchr (item, ';'); semi; semi = strchr (semi + 1, ';')) {
+		for (semi = strchr (iter->data, ';'); semi; semi = strchr (semi + 1, ';')) {
 			param = skip_lws (semi + 1);
 			if (*param != 'q')
 				continue;
@@ -577,15 +576,15 @@ soup_header_parse_quality_list (const char *header, GSList **unacceptable)
 		if (qval == 0.0) {
 			if (unacceptable) {
 				*unacceptable = g_slist_prepend (*unacceptable,
-								 item);
+								 g_steal_pointer (&iter->data));
 			}
 		} else {
-			array[n].item = item;
+			array[n].item = g_steal_pointer (&iter->data);
 			array[n].qval = qval;
 			n++;
 		}
 	}
-	g_slist_free (unsorted);
+	g_slist_free_full (unsorted, g_free);
 
 	qsort (array, n, sizeof (QualityItem), sort_by_qval);
 	sorted = NULL;
-- 
2.49.0