Backport upstream commit 5f6d86b50bebf5458ab1becf4de2c5e5f066122b
to fix CVE-2026-58014, a one-byte heap under-read in
g_key_file_get_locale_string_list() when called on a key with
an empty value. The fix adds a `len > 0` guard before accessing
value[len-1]. The patch also includes a unit test and fuzzing
test enhancement.
CVE: CVE-2026-58014
Upstream patches:
- 5f6d86b50b.patch
Resolves: RHEL-190604
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
