.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -1 +1 @@
-SOURCES/glib-2.56.4.tar.xz
+/glib-2.*.tar.xz

.glib2.metadata

@@ -1 +0,0 @@
-4064eb1eb5ff626c211e86bc939f8b743ceafaba SOURCES/glib-2.56.4.tar.xz

569.patch

@@ -0,0 +1,47 @@
+From 4ef58e5661849317a1110c9b93957f2c608677dd Mon Sep 17 00:00:00 2001
+From: Simon McVittie <smcv@collabora.com>
+Date: Thu, 3 Jan 2019 08:21:40 +0000
+Subject: [PATCH 2/2] gvariant test: Also force alignment for tuple test data
+
+glib!552 (commit 9eed22b3) fixed this for the tests that failed on i686,
+but this additional test failed on Debian's s390x port
+(IBM z/Architecture, 64-bit big-endian).
+
+Signed-off-by: Simon McVittie <smcv@collabora.com>
+---
+ glib/tests/gvariant.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/glib/tests/gvariant.c b/glib/tests/gvariant.c
+index a7b19826d..c4a996c1f 100644
+--- a/glib/tests/gvariant.c
++++ b/glib/tests/gvariant.c
+@@ -4820,6 +4820,7 @@ test_normal_checking_array_offsets (void)
+ static void
+ test_normal_checking_tuple_offsets (void)
+ {
++  gpointer aligned_data;
+   const guint8 data[] = {
+     0x07, 0xe5, 0x00, 0x07, 0x00, 0x07,
+     '(', 'a', 's', 'a', 's', 'a', 's', 'a', 's', 'a', 's', 'a', 's', ')',
+@@ -4828,13 +4829,15 @@ test_normal_checking_tuple_offsets (void)
+   GVariant *variant = NULL;
+   GVariant *normal_variant = NULL;
+ 
+-  variant = g_variant_new_from_data (G_VARIANT_TYPE_VARIANT, data, size,
+-                                     FALSE, NULL, NULL);
++  aligned_data = g_memdup (data, size); /* guarantee alignment */
++  variant = g_variant_new_from_data (G_VARIANT_TYPE_VARIANT, aligned_data,
++                                     size, FALSE, NULL, NULL);
+   g_assert_nonnull (variant);
+ 
+   normal_variant = g_variant_get_normal_form (variant);
+   g_assert_nonnull (normal_variant);
+ 
++  g_free (aligned_data);
+   g_variant_unref (normal_variant);
+   g_variant_unref (variant);
+ }
+-- 
+2.19.1
+

CVE-2026-58016.patch

@@ -0,0 +1,87 @@
+From 01d02a2d7cb54c7e27174ed344d03e0c49e0b862 Mon Sep 17 00:00:00 2001
+From: Philip Withnall <pwithnall@gnome.org>
+Date: Thu, 16 Apr 2026 15:27:37 +0100
+Subject: [PATCH] gdbusintrospection: Fix XML parser state handling for <node>
+ element nesting
+
+The check for whether a `<node>` element in D-Bus introspection XML was
+nested correctly was broken. `<node>` elements can only be at the top
+level, or nested immediately within another `<node>` element.
+
+Fix the check and add some unit tests for it.
+
+Spotted by linhlhq as #YWH-PGM9867-204. The fix is mine, and the unit test
+uses example XML strings adapted from their report.
+
+Signed-off-by: Philip Withnall <pwithnall@gnome.org>
+
+Fixes: #3932
+---
+ gio/gdbusintrospection.c        |  2 +-
+ gio/tests/gdbus-introspection.c | 33 +++++++++++++++++++++++++++++++++
+ 2 files changed, 34 insertions(+), 1 deletion(-)
+
+diff --git a/gio/gdbusintrospection.c b/gio/gdbusintrospection.c
+index e9601dbbd..7925af507 100644
+--- a/gio/gdbusintrospection.c
++++ b/gio/gdbusintrospection.c
+@@ -1270,7 +1270,7 @@ parser_start_element (GMarkupParseContext  *context,
+   /* ---------------------------------------------------------------------------------------------------- */
+   if (strcmp (element_name, "node") == 0)
+     {
+-      if (!(g_slist_length (stack) >= 1 || strcmp (stack->next->data, "node") != 0))
++      if (stack->next != NULL && strcmp (stack->next->data, "node") != 0)
+         {
+           g_set_error_literal (error,
+                                G_MARKUP_ERROR,
+diff --git a/gio/tests/gdbus-introspection.c b/gio/tests/gdbus-introspection.c
+index 50c0cc721..e2cdf0a25 100644
+--- a/gio/tests/gdbus-introspection.c
++++ b/gio/tests/gdbus-introspection.c
+@@ -297,6 +297,38 @@ test_extra_data (void)
+   g_dbus_node_info_unref (info);
+ }
+ 
++static void
++test_invalid (void)
++{
++  const struct
++    {
++      const char *xml;
++      GMarkupError expected_error_code;
++    }
++  vectors[] =
++    {
++      { "", G_MARKUP_ERROR_EMPTY },
++      { "<node><interface name=\"I\"><method name=\"M\"><node><interface name=\"I2\"></interface></node></method>", G_MARKUP_ERROR_INVALID_CONTENT },
++      { "<node><interface name=\"I\"><signal name=\"S\"><node><interface name=\"I2\"><signal name=\"S2\"></signal></interface></node></signal>", G_MARKUP_ERROR_INVALID_CONTENT },
++      { "<node><interface name=\"I\"><property name=\"P\" type=\"s\" access=\"read\"><node><interface name=\"I2\"></interface></node></property>", G_MARKUP_ERROR_INVALID_CONTENT },
++      { "<node><interface name=\"I\"><method name=\"M\"><arg type=\"\"><node><interface name=\"I2\"><method name=\"M2\"></method></interface></node></arg>", G_MARKUP_ERROR_INVALID_CONTENT },
++    };
++
++  for (size_t i = 0; i < G_N_ELEMENTS (vectors); i++)
++    {
++      GDBusNodeInfo *node;
++      GError *local_error = NULL;
++
++      g_test_message ("Testing parsing of %s gives an error", vectors[i].xml);
++
++      node = g_dbus_node_info_new_for_xml (vectors[i].xml, &local_error);
++      g_assert_error (local_error, G_MARKUP_ERROR, (int) vectors[i].expected_error_code);
++      g_assert_null (node);
++
++      g_clear_error (&local_error);
++    }
++}
++
+ /* ---------------------------------------------------------------------------------------------------- */
+ 
+ int
+@@ -314,6 +346,7 @@ main (int   argc,
+   g_test_add_func ("/gdbus/introspection-generate", test_generate);
+   g_test_add_func ("/gdbus/introspection-default-direction", test_default_direction);
+   g_test_add_func ("/gdbus/introspection-extra-data", test_extra_data);
++  g_test_add_func ("/gdbus/introspection-invalid", test_invalid);
+ 
+   ret = session_bus_run ();
+ 

gating.yaml

@@ -0,0 +1,6 @@
+--- !Policy
+product_versions:
+  - rhel-8
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: desktop-qe.desktop-ci.tier1-gating.functional}

glib2.spec

@@ -5,7 +5,7 @@
 
 Name: glib2
 Version: 2.56.4
-Release: 169%{?dist}
+Release: 170%{?dist}
 Summary: A library of handy utility functions
 
 License: LGPLv2+
@@ -169,6 +169,9 @@ Patch34: CVE-2025-14087.patch
 # https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4935
 Patch35: CVE-2025-14512.patch
 
+# https://github.com/GNOME/glib/commit/c9da977c178fbfc0e4caf99f9fdf5dc433d6fcc2
+Patch36: CVE-2026-58016.patch
+
 %description
 GLib is the low-level core library that forms the basis for projects
 such as GTK+ and GNOME. It provides data structure handling for C,
@@ -369,6 +372,10 @@ make %{?_smp_mflags} check
 %{_datadir}/installed-tests
 
 %changelog
+* Thu Jul 09 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.56.4-170
+- Add patch for CVE-2026-58016
+- Resolves: RHEL-190622
+
 * Fri Apr 24 2026 Michael Catanzaro <mcatanzaro@redhat.com> - 2.68.4-169
 - Add patch for CVE-2025-14087 and CVE-2025-14512
 

main.fmf

@@ -0,0 +1,5 @@
+plan:
+    import:
+        url: https://gitlab.cee.redhat.com/desktopqe/glib2.git
+        name: /plan/gate
+        ref: rhel-8

rpminspect.yaml

@@ -0,0 +1,17 @@
+---
+annocheck:
+    ignore:
+        - /usr/libexec/installed-tests/glib/mem-overflow
+        - /usr/libexec/installed-tests/glib/resources
+elf:
+    ignore:
+        - /usr/libexec/installed-tests/glib/resources
+inspections:
+    # https://gitlab.gnome.org/GNOME/glib/-/merge_requests/2097
+    badfuncs: off
+runpath:
+    allowed_paths:
+        - /usr/libexec/installed-tests/glib
+xml:
+    ignore:
+        - /usr/libexec/installed-tests/glib/bookmarks/fail-*.xbel

sources

@@ -0,0 +1 @@
+SHA512 (glib-2.56.4.tar.xz) = 280a46c2af13283a08c15ff0b4f5492659c2884521930600ad45310ed181c44a878ad8f9b36bae68ed6e7d92db6f1630f7bf015148c513dc317d25807f13abb0

update-gio-modules

@@ -0,0 +1,19 @@
+#! /bin/sh
+
+if test $# != 1; then
+  echo "usage: update-gio-modules host_triplet" 1>&2
+  exit 1
+fi
+
+echo "Warning: update-gio-modules is deprecated and will be removed in glib2-2.28.0"
+
+umask 022
+
+case "$host" in
+  alpha*|ia64*|powerpc64*|ppc64*|s390x*|sparc64*|x86_64*)
+    /usr/bin/gio-querymodules-64 /usr/lib64/gio/modules
+    ;;
+  *)
+    /usr/bin/gio-querymodules-32 /usr/lib/gio/modules
+    ;;
+esac