Update ChangeLog and bump version for v2.6.2 release

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

.github/SECURITY.md

@@ -0,0 +1,12 @@
+# Security Policy
+
+## Supported Versions
+
+libite (-lite) is a small project, as such we have no possibility to support older versions.
+The only supported version is the latest released on GitHub:
+
+<https://github.com/troglobit/libite/releases>
+
+## Reporting a Vulnerability
+
+Contact the project's main author and owner to report and discuss vulnerabilities.

.github/workflows/build.yml

@@ -28,7 +28,7 @@ jobs:
         run: |
           sudo apt-get -y update
           sudo apt-get -y install tree doxygen
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Configure
         run: |
           ./autogen.sh
@@ -44,7 +44,7 @@ jobs:
         run: |
           make check || (cat test/test-suite.log; false)
       - name: Upload Test Results
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: libite-test-${{ matrix.compiler }}
           path: test/*
@@ -55,7 +55,7 @@ jobs:
     env:
       MAKEFLAGS: -j3
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Installing dependencies
         run: |
           apt-get update

.github/workflows/coverity.yml

@@ -15,7 +15,7 @@ jobs:
   coverity:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Fetch latest Coverity Scan MD5
         id: var
         env:
@@ -25,7 +25,7 @@ jobs:
                --post-data "token=$TOKEN&project=${COVERITY_PROJ}&md5=1" \
                -O coverity-latest.tar.gz.md5
           echo "md5=$(cat coverity-latest.tar.gz.md5)" | tee -a $GITHUB_OUTPUT
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
         id: cache
         with:
           path: coverity-latest.tar.gz
@@ -74,7 +74,7 @@ jobs:
             --form description="${PROJECT_NAME} $(git rev-parse HEAD)" \
             https://scan.coverity.com/builds?project=${COVERITY_PROJ}
       - name: Upload build.log
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: coverity-build.log
           path: cov-int/build-log.txt

.github/workflows/release.yml

@@ -11,7 +11,7 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Installing dependencies ...
         run: |
           sudo apt-get -y update

ChangeLog.md

@@ -4,6 +4,14 @@ Change Log
 All notable changes to the project are documented in this file.
 
 
+[v2.6.2][] - 2025-11-22
+-----------------------
+
+### Fixes
+- Fix memory leak in `which()` on `realloc()` failure
+- Fix `pidfile()` to handle missing trailing slash in prefix path
+
+
 [v2.6.1][] - 2023-10-15
 -----------------------
 
@@ -511,7 +519,8 @@ problems this may cause!
 Initial extraction of frog DNA from [Finit][].  See [README][] for API details.
 
 
-[UNRELEASED]: https://github.com/troglobit/libite/compare/v2.6.1...HEAD
+[UNRELEASED]: https://github.com/troglobit/libite/compare/v2.6.2...HEAD
+[v2.6.2]: https://github.com/troglobit/libite/compare/v2.6.1...v2.6.2
 [v2.6.1]: https://github.com/troglobit/libite/compare/v2.6.0...v2.6.1
 [v2.6.0]: https://github.com/troglobit/libite/compare/v2.5.3...v2.6.0
 [v2.5.3]: https://github.com/troglobit/libite/compare/v2.5.2...v2.5.3

TODO.org

@@ -1 +1,15 @@
 * TODO Write tests for new APIs
+
+* More formatted variants?
+- symlinkf()
+- accessf()
+- statf() / lstatf()
+
+* Relocate from Finit
+
+- fnread()
+- fnwrite()
+- fngetint()
+- paste()
+- unquote()
+

configure.ac

@@ -1,4 +1,4 @@
-AC_INIT(libite, 2.6.1, https://github.com/troglobit/libite/issues)
+AC_INIT(libite, 2.6.2, https://github.com/troglobit/libite/issues)
 AC_CONFIG_AUX_DIR(aux)
 AM_INIT_AUTOMAKE([1.11 foreign dist-xz])
 AM_SILENT_RULES([yes])

src/pidfile.c

@@ -45,6 +45,7 @@
 #include <paths.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <string.h>
 #include <unistd.h>
 
 #ifndef pidfile
@@ -93,7 +94,10 @@ int pidfile(const char *basename)
 	}
 
 	if (basename[0] != '/') {
-		if (asprintf(&pidfile_path, "%s%s.pid", __pidfile_path, basename) == -1)
+		size_t len = strlen(__pidfile_path);
+		int slash = __pidfile_path[len > 0 ? len - 1 : 0] != '/';
+
+		if (asprintf(&pidfile_path, "%s%s%s.pid", __pidfile_path, slash ? "/" : "", basename) == -1)
 			return (-1);
 	} else {
 		if (asprintf(&pidfile_path, "%s", basename) == -1)

src/which.c

@@ -53,8 +53,9 @@ static char *strip_args(char *path)
  */
 char *which(const char *cmd)
 {
+	char *ptr, *env, *path = NULL;
 	size_t pathlen = 0;
-	char *ptr, *tok, *env, *path = NULL;
+	const char *tok;
 
 	if (!cmd) {
 		errno = EINVAL;
@@ -69,9 +70,7 @@ char *which(const char *cmd)
 		if (!access(path, X_OK))
 			return path;
 
-		if (path)
+		free(path);
-			free(path);
-
 		return NULL;
 	}
 
@@ -88,11 +87,15 @@ char *which(const char *cmd)
 		size_t len = strlen(tok) + strlen(cmd) + 2;
 
 		if (pathlen < len) {
-			path = realloc(path, len);
+			char *tmp = realloc(path, len);
-			if (!path) {
+
+			if (!tmp) {
+				free(path);
 				free(env);
 				return NULL;
 			}
+
+			path = tmp;
 			pathlen = len;
 		}