b202462ce6
Backport upstream fix for CVE-2026-58014 from GNOME/glib MR !5171. The patch adds a `len > 0` guard before accessing `value[len - 1]` in g_key_file_get_locale_string_list() to prevent a one-byte heap under-read when the key value is empty. Includes a unit test for the fix. CVE: CVE-2026-58014 Upstream patches: - https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5171.patch Resolves: RHEL-190587 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir
75 lines
2.4 KiB
Diff
75 lines
2.4 KiB
Diff
From d3e1d6f9ea497bd1b6bb258c6d078f06b8cd4338 Mon Sep 17 00:00:00 2001
|
|
From: Philip Withnall <pwithnall@gnome.org>
|
|
Date: Sat, 11 Apr 2026 14:42:57 +0100
|
|
Subject: [PATCH] gkeyfile: Fix a one-byte heap under-read with
|
|
g_key_file_get_locale_string_list()
|
|
|
|
If this method was called on a key file key which has an empty value,
|
|
`len == 0` and this leads to a one-byte under-read off the start of the
|
|
key file buffer.
|
|
|
|
Spotted by linhlhq as #YWH-PGM9867-200. The suggested fix is theirs, and
|
|
the unit test is adapted from their report. I added the fuzzing test.
|
|
|
|
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
|
|
|
|
Fixes: #3930
|
|
---
|
|
glib/gkeyfile.c | 2 +-
|
|
glib/tests/keyfile.c | 22 ++++++++++++++++++++++
|
|
2 files changed, 23 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/glib/gkeyfile.c b/glib/gkeyfile.c
|
|
index ae3bbbc1d..0ddde22db 100644
|
|
--- a/glib/gkeyfile.c
|
|
+++ b/glib/gkeyfile.c
|
|
@@ -2391,7 +2391,7 @@ g_key_file_get_locale_string_list (GKeyFile *key_file,
|
|
}
|
|
|
|
len = strlen (value);
|
|
- if (value[len - 1] == key_file->list_separator)
|
|
+ if (len > 0 && value[len - 1] == key_file->list_separator)
|
|
value[len - 1] = '\0';
|
|
|
|
list_separator[0] = key_file->list_separator;
|
|
diff --git a/glib/tests/keyfile.c b/glib/tests/keyfile.c
|
|
index 16f3b788b..d7c648260 100644
|
|
--- a/glib/tests/keyfile.c
|
|
+++ b/glib/tests/keyfile.c
|
|
@@ -751,6 +751,27 @@ test_locale_string (void)
|
|
g_free (old_locale);
|
|
}
|
|
|
|
+static void
|
|
+test_locale_string_empty (void)
|
|
+{
|
|
+ GKeyFile *keyfile = NULL;
|
|
+ GError *local_error = NULL;
|
|
+ const char *data =
|
|
+ "[valid]\n"
|
|
+ "key1=\n";
|
|
+
|
|
+ g_test_bug ("https://gitlab.gnome.org/GNOME/glib/-/issues/3930");
|
|
+
|
|
+ keyfile = g_key_file_new ();
|
|
+
|
|
+ g_key_file_load_from_data (keyfile, data, -1, G_KEY_FILE_NONE, &local_error);
|
|
+ g_assert_no_error (local_error);
|
|
+
|
|
+ check_locale_string_list_value (keyfile, "valid", "key1", NULL, NULL);
|
|
+
|
|
+ g_key_file_free (keyfile);
|
|
+}
|
|
+
|
|
static void
|
|
test_lists (void)
|
|
{
|
|
@@ -1745,6 +1766,7 @@ main (int argc, char *argv[])
|
|
g_test_add_func ("/keyfile/boolean", test_boolean);
|
|
g_test_add_func ("/keyfile/number", test_number);
|
|
g_test_add_func ("/keyfile/locale-string", test_locale_string);
|
|
+ g_test_add_func ("/keyfile/locale-string/empty", test_locale_string_empty);
|
|
g_test_add_func ("/keyfile/lists", test_lists);
|
|
g_test_add_func ("/keyfile/lists-set-get", test_lists_set_get);
|
|
g_test_add_func ("/keyfile/group-remove", test_group_remove);
|