Stop loading modules from cwd

Resolves: RHEL-46988
This commit is contained in:
Matthias Clasen 2024-07-10 14:50:26 -04:00
parent 04b3b318d2
commit 7f2cdaf4e0
2 changed files with 44 additions and 1 deletions

View File

@ -0,0 +1,35 @@
From 3bbf0b6176d42836d23c36a6ac410e807ec0a7a7 Mon Sep 17 00:00:00 2001
From: Matthias Clasen <mclasen@redhat.com>
Date: Sat, 15 Jun 2024 14:18:01 -0400
Subject: [PATCH] Stop looking for modules in cwd
This is just not a good idea. It is surprising, and can be misused.
Fixes: #6786
---
gtk/gtkmodules.c | 9 ++-------
1 file changed, 2 insertions(+), 7 deletions(-)
diff --git a/gtk/gtkmodules.c b/gtk/gtkmodules.c
index 704e412aeb..f93101c272 100644
--- a/gtk/gtkmodules.c
+++ b/gtk/gtkmodules.c
@@ -214,13 +214,8 @@ find_module (const gchar *name)
gchar *module_name;
module_name = _gtk_find_module (name, "modules");
- if (!module_name)
- {
- /* As last resort, try loading without an absolute path (using system
- * library path)
- */
- module_name = g_module_build_path (NULL, name);
- }
+ if (module_name == NULL)
+ return NULL;
module = g_module_open (module_name, G_MODULE_BIND_LOCAL | G_MODULE_BIND_LAZY);
--
2.45.2

View File

@ -22,7 +22,7 @@
Name: gtk3 Name: gtk3
Version: 3.22.30 Version: 3.22.30
Release: 11%{?dist} Release: 12%{?dist}
Summary: GTK+ graphical user interface library Summary: GTK+ graphical user interface library
License: LGPLv2+ License: LGPLv2+
@ -58,6 +58,8 @@ Patch14: 0001-Remove-the-without-parent-warning.patch
# Fix the rpminspect warning # Fix the rpminspect warning
# https://gitlab.gnome.org/GNOME/gtk/-/commit/5e673e94de3f59e3b937ce14d22b8c07c6e975cd # https://gitlab.gnome.org/GNOME/gtk/-/commit/5e673e94de3f59e3b937ce14d22b8c07c6e975cd
Patch15: gtk3-icon-browser-no-icon.patch Patch15: gtk3-icon-browser-no-icon.patch
# Fix loading modules from cwd
Patch16: 0001-Stop-looking-for-modules-in-cwd.patch
BuildRequires: pkgconfig(atk) >= %{atk_version} BuildRequires: pkgconfig(atk) >= %{atk_version}
BuildRequires: pkgconfig(atk-bridge-2.0) BuildRequires: pkgconfig(atk-bridge-2.0)
@ -211,6 +213,8 @@ the functionality of the installed %{name} package.
%patch12 -p1 %patch12 -p1
%patch13 -p1 %patch13 -p1
%patch14 -p1 %patch14 -p1
%patch15 -p1
%patch16 -p1
%build %build
export CFLAGS='-fno-strict-aliasing %optflags' export CFLAGS='-fno-strict-aliasing %optflags'
@ -369,6 +373,10 @@ gtk-query-immodules-3.0-%{__isa_bits} --update-cache &>/dev/null || :
%{_datadir}/installed-tests %{_datadir}/installed-tests
%changelog %changelog
* Wed Jul 10 2024 Matthias Clasen <mclasen@redhat.com> - 3.22.30-12
- Stop loading modules from cwd (CVE-2024-6655)
- Resolves: RHEL-46988
* Mon Aug 22 2022 Carlos Garnacho <cgarnach@redhat.com> - 3.22.30-11 * Mon Aug 22 2022 Carlos Garnacho <cgarnach@redhat.com> - 3.22.30-11
- Drop warning about unparented dialogs (#2058260) - Drop warning about unparented dialogs (#2058260)