Backport upstream fix for CVE-2026-58013, which addresses a
buffer over-read in GIOChannel when using multi-byte line
terminators. The memcmp() call could read past the end of
the internal GString buffer when the line extends to the
buffer boundary. The patch adds a length check before the
memcmp() and includes a new unit test. The test was adapted
for GLib 2.68 by replacing unavailable C99/GLib 2.70
constructs (uint8_t, g_steal_fd) with their GLib 2.68
equivalents.
CVE: CVE-2026-58013
Upstream patches:
- 9f557746c5.patch
Resolves: RHEL-212237
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
