Builder wget-solaris10-sparc Build #581

Results:

Failed shell shell_1 shell_2 shell_3

SourceStamp:

BuildSlave:

Reason:

The SingleBranchScheduler scheduler named 'schedule-wget-solaris10-sparc' triggered this build

Steps and Logfiles:

1. git update ( 25 secs )
   1. stdio
2. shell 'bash bootstrap' failed ( 25 secs )
   1. stdio
3. shell_1 './configure' failed ( 0 secs )
   1. stdio
   2. src/config.h
   3. config.log
4. shell_2 'gmake' failed ( 0 secs )
   1. stdio
5. shell_3 'gmake check' failed ( 0 secs )
   1. stdio
   2. tests-unit-tests.log
   3. tests-test-suite.log
   4. testenv-test-suite.log

Build Properties:

Forced Build Properties:

Responsible Users:

1. Oriol Torrent Santiago

   oriol.torrentohnoyoudont@gmail.com
2. Tim Rühsen

   tim.ruehsenohnoyoudont@gmx.de

Timing:

All Changes:

:

1. Change #281761

   Category	wget
   Changed by	Tim Rühsen <tim.ruehsenohnoyoudont@gmx.de>
   Changed at	Mon 14 Sep 2026 11:53:20
   Repository	https://gitlab.com/gnuwget/wget.git
   Project	wget
   Branch	master
   Revision	0a258bd60afc321dc3d1944c1ef838c8446a67cf

   Comments

   Make use of clang's ownership_takes attribute
   This allows scan-build to find a use-after-free introduced by
   commit 581b53633159200125bcdee697762c62449b1067 (not released).
   
   * bootstrap.conf: Add attribute gnulib module.
   * src/wget.h: Define ATTRIBUTE_OWNERSHIP_TAKES.
   * src/html-url.h: Make use of ATTRIBUTE_OWNERSHIP_TAKES.
   * src/http-ntlm.h: Likewise.
   * src/iri.h: Likewise.
   * src/ptimer.h: Likewise.
   * src/url.c: New function url_new() as a wraper to xnew0() to
     suppress a -Wmismatched-dealloc warning.
   * src/url.h: Make use of ATTRIBUTE_OWNERSHIP_TAKES.
   * src/utils.h: Likewise.

   Changed files

   • bootstrap.conf
   • src/html-url.h
   • src/http-ntlm.h
   • src/iri.h
   • src/ptimer.h
   • src/url.c
   • src/url.h
   • src/utils.h
   • src/wget.h

2. Change #281762

   Category	wget
   Changed by	Oriol Torrent Santiago <oriol.torrentohnoyoudont@gmail.com>
   Changed at	Mon 14 Sep 2026 12:20:30
   Repository	https://gitlab.com/gnuwget/wget.git
   Project	wget
   Branch	master
   Revision	34b9afbafb52f9296e5a9105c71059aea9c38987

   Comments

   Fix headers leak and use-after-free
   The vulnerable logic was introduced by commit
   581b53633159200125bcdee697762c62449b1067.
   
   There were three problems:
   
   1. The URI scheme was missing. RFC 6454 defines an origin from scheme, host,
      and port, so HTTPS and HTTP cannot be treated as the same origin.
   2. The comparison was against the immediately preceding redirect target, rather
      than the initial origin trusted by the user. A later same-origin hop on an
      untrusted target therefore cleared the protection.
   3. When u was an intermediate URL, it was freed before its fields were read.
   
   * src/retr.c (retrieve_url): Add URI scheme comparison, compare with origin,
     fix use-after-free.
   
   Fixes https://gitlab.com/gnuwget/wget/-/work_items/31
   
   Copyright-paperwork-exempt: Yes

   Changed files

   • src/retr.c