Fix potential leak, do not allow replacement of discovered pkgs

This fixes an issue in flat clones of repos, whereby an expanded repo may then
contain a .spec file further inside the tree beyond its own .spec file, noticed
specifically in RPM setups.

Signed-off-by: Ikey Doherty <[email protected]>

Author: Ikey Doherty

src/main.c

@@ -95,7 +95,8 @@ static void cve_add_package_internal(struct source_package_t *pkg)
         }
 
         if (g_hash_table_contains(self->db, pkg->name)) {
-                g_hash_table_remove(self->db, pkg->name);
+                package_free(pkg);
+                return;
         }
 
         if (self->mapping) {
@@ -529,7 +530,6 @@ static bool cve_locate(const char *path, bool recurse)
         bool ret = false;
         DIR *dir = NULL;
         struct dirent *ent = NULL;
-        char *fullp = NULL;
 
         if (!pkg_plugin || !(pkg_plugin->flags & PLUGIN_TYPE_PACKAGE) || !pkg_plugin->is_package) {
                 fprintf(stderr, "Abnormal configuration in plugin\n");
@@ -549,13 +549,13 @@ static bool cve_locate(const char *path, bool recurse)
                 }
                 while ((ent = readdir(dir))) {
                         if (!streq(ent->d_name, ".") && !streq(ent->d_name, "..")) {
+                                autofree(char) *fullp = NULL;
                                 if (!asprintf(&fullp, "%s/%s", path, ent->d_name)) {
                                         goto end;
                                 }
                                 if (!(cve_is_dir(fullp) && !recurse)) {
                                         cve_locate(fullp, recurse);
                                 }
-                                free(fullp);
                         }
                 }
         } else if (S_ISREG(st.st_mode)) {