Backport upstream fix for CVE-2026-58014 from GNOME/glib MR !5171.
The patch adds a `len > 0` guard before accessing `value[len - 1]`
in g_key_file_get_locale_string_list() to prevent a one-byte heap
under-read when the key value is empty. Includes a unit test for
the fix.
CVE: CVE-2026-58014
Upstream patches:
- https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5171.patch
Resolves: RHEL-190587
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
