Backport upstream commit aa1cb87d56111ef989811e824f0ac77484cc997f
to fix CVE-2026-58010, an off-by-one error in
gvs_tuple_is_normal() in glib/gvariant-serialiser.c.
The bug allowed a single byte out-of-bounds read off the end
of a GVariant's backing byte array during normal form checking.
The fix changes `>` to `>=` in an offset bounds check, and a
regression test is included.
CVE: CVE-2026-58010
Upstream patches:
- aa1cb87d56.patch
Resolves: RHEL-212171
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
