From b202462ce67567db3a34f102c9474cb54c934a29 Mon Sep 17 00:00:00 2001
From: RHEL Packaging Agent <redhat-ymir-agent@redhat.com>
Date: Sun, 12 Jul 2026 08:59:46 +0000
Subject: [PATCH] Fix CVE-2026-58014: heap under-read in
 g_key_file_get_locale_string_list()

Backport upstream fix for CVE-2026-58014 from GNOME/glib MR !5171.
The patch adds a `len > 0` guard before accessing `value[len - 1]`
in g_key_file_get_locale_string_list() to prevent a one-byte heap
under-read when the key value is empty. Includes a unit test for
the fix.

CVE: CVE-2026-58014
Upstream patches:
 - https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5171.patch
Resolves: RHEL-190587

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
---
 CVE-2026-58014.patch | 74 ++++++++++++++++++++++++++++++++++++++++++++
 glib2.spec           |  9 +++++-
 2 files changed, 82 insertions(+), 1 deletion(-)
 create mode 100644 CVE-2026-58014.patch

diff --git a/CVE-2026-58014.patch b/CVE-2026-58014.patch
new file mode 100644
index 0000000..30a1f59
--- /dev/null
+++ b/CVE-2026-58014.patch
@@ -0,0 +1,74 @@
+From d3e1d6f9ea497bd1b6bb258c6d078f06b8cd4338 Mon Sep 17 00:00:00 2001
+From: Philip Withnall <pwithnall@gnome.org>
+Date: Sat, 11 Apr 2026 14:42:57 +0100
+Subject: [PATCH] gkeyfile: Fix a one-byte heap under-read with
+ g_key_file_get_locale_string_list()
+
+If this method was called on a key file key which has an empty value,
+`len == 0` and this leads to a one-byte under-read off the start of the
+key file buffer.
+
+Spotted by linhlhq as #YWH-PGM9867-200. The suggested fix is theirs, and
+the unit test is adapted from their report. I added the fuzzing test.
+
+Signed-off-by: Philip Withnall <pwithnall@gnome.org>
+
+Fixes: #3930
+---
+ glib/gkeyfile.c      |  2 +-
+ glib/tests/keyfile.c | 22 ++++++++++++++++++++++
+ 2 files changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/glib/gkeyfile.c b/glib/gkeyfile.c
+index ae3bbbc1d..0ddde22db 100644
+--- a/glib/gkeyfile.c
++++ b/glib/gkeyfile.c
+@@ -2391,7 +2391,7 @@ g_key_file_get_locale_string_list (GKeyFile     *key_file,
+     }
+ 
+   len = strlen (value);
+-  if (value[len - 1] == key_file->list_separator)
++  if (len > 0 && value[len - 1] == key_file->list_separator)
+     value[len - 1] = '\0';
+ 
+   list_separator[0] = key_file->list_separator;
+diff --git a/glib/tests/keyfile.c b/glib/tests/keyfile.c
+index 16f3b788b..d7c648260 100644
+--- a/glib/tests/keyfile.c
++++ b/glib/tests/keyfile.c
+@@ -751,6 +751,27 @@ test_locale_string (void)
+   g_free (old_locale);
+ }
+ 
++static void
++test_locale_string_empty (void)
++{
++  GKeyFile *keyfile = NULL;
++  GError *local_error = NULL;
++  const char *data =
++    "[valid]\n"
++    "key1=\n";
++
++  g_test_bug ("https://gitlab.gnome.org/GNOME/glib/-/issues/3930");
++
++  keyfile = g_key_file_new ();
++
++  g_key_file_load_from_data (keyfile, data, -1, G_KEY_FILE_NONE, &local_error);
++  g_assert_no_error (local_error);
++
++  check_locale_string_list_value (keyfile, "valid", "key1", NULL, NULL);
++
++  g_key_file_free (keyfile);
++}
++
+ static void
+ test_lists (void)
+ {
+@@ -1745,6 +1766,7 @@ main (int argc, char *argv[])
+   g_test_add_func ("/keyfile/boolean", test_boolean);
+   g_test_add_func ("/keyfile/number", test_number);
+   g_test_add_func ("/keyfile/locale-string", test_locale_string);
++  g_test_add_func ("/keyfile/locale-string/empty", test_locale_string_empty);
+   g_test_add_func ("/keyfile/lists", test_lists);
+   g_test_add_func ("/keyfile/lists-set-get", test_lists_set_get);
+   g_test_add_func ("/keyfile/group-remove", test_group_remove);
diff --git a/glib2.spec b/glib2.spec
index 3ccc740..6387137 100644
--- a/glib2.spec
+++ b/glib2.spec
@@ -5,7 +5,7 @@
 
 Name: glib2
 Version: 2.56.4
-Release: 170%{?dist}
+Release: 171%{?dist}
 Summary: A library of handy utility functions
 
 License: LGPLv2+
@@ -172,6 +172,9 @@ Patch35: CVE-2025-14512.patch
 # https://github.com/GNOME/glib/commit/c9da977c178fbfc0e4caf99f9fdf5dc433d6fcc2
 Patch36: CVE-2026-58016.patch
 
+# https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5171
+Patch37: CVE-2026-58014.patch
+
 %description
 GLib is the low-level core library that forms the basis for projects
 such as GTK+ and GNOME. It provides data structure handling for C,
@@ -372,6 +375,10 @@ make %{?_smp_mflags} check
 %{_datadir}/installed-tests
 
 %changelog
+* Sun Jul 12 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.56.4-171
+- Fix one-byte heap under-read in g_key_file_get_locale_string_list()
+- Resolves: RHEL-190587
+
 * Thu Jul 09 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.56.4-170
 - Add patch for CVE-2026-58016
 - Resolves: RHEL-190622