Fix CVE-2026-58011 in mingw-glib2: g_date_time_add_full() range validation
Backport upstream fix for CVE-2026-58011 to mingw-glib2 2.70.1. Two upstream commits were cherry-picked and combined into a single patch (Patch3): - Factor out MIN_DAYS/MAX_DAYS magic constants in gdatetime.c - Add missing range validation to g_date_time_add_full() to prevent creation of invalid GDateTime objects, along with corresponding test cases. CVE: CVE-2026-58011 Upstream patches: -7f0f7d0870.patch -ededb77ea0.patch Resolves: RHEL-212184 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent
parent
71f0ac4d01
commit
16e08b276e
122
mingw-glib2-2.70.1-CVE-2026-58011.patch
Normal file
122
mingw-glib2-2.70.1-CVE-2026-58011.patch
Normal file
@ -0,0 +1,122 @@
|
||||
From fbef21c7da7757239d6df411a24c7dbb345ab966 Mon Sep 17 00:00:00 2001
|
||||
From: Philip Withnall <pwithnall@gnome.org>
|
||||
Date: Sun, 29 Mar 2026 23:19:47 +0100
|
||||
Subject: [PATCH 1/2] gdatetime: Factor out a couple of magic constants
|
||||
|
||||
This introduces no functional changes, it just makes the code a little
|
||||
clearer.
|
||||
|
||||
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
|
||||
---
|
||||
glib/gdatetime.c | 9 ++++++---
|
||||
1 file changed, 6 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/glib/gdatetime.c b/glib/gdatetime.c
|
||||
index a31afe713..029636c08 100644
|
||||
--- a/glib/gdatetime.c
|
||||
+++ b/glib/gdatetime.c
|
||||
@@ -130,7 +130,7 @@ struct _GDateTime
|
||||
gint interval;
|
||||
|
||||
/* 1 is 0001-01-01 in Proleptic Gregorian */
|
||||
- gint32 days;
|
||||
+ gint32 days; /* in range [MIN_DAYS, MAX_DAYS] */
|
||||
|
||||
gint ref_count; /* (atomic) */
|
||||
};
|
||||
@@ -172,6 +172,9 @@ struct _GDateTime
|
||||
#define JULIAN_YEAR(d) ((d)->julian / 365.25)
|
||||
#define DAYS_PER_PERIOD (G_GINT64_CONSTANT (2914695))
|
||||
|
||||
+#define MIN_DAYS 1 /* the days count for 0001-01-01 in Proleptic Gregorian */
|
||||
+#define MAX_DAYS 3652059 /* the days count for 9999-12-31 in Proleptic Gregorian */
|
||||
+
|
||||
static const guint16 days_in_months[2][13] =
|
||||
{
|
||||
{ 0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 },
|
||||
@@ -781,7 +784,7 @@ g_date_time_from_instant (GTimeZone *tz,
|
||||
datetime->days = instant / USEC_PER_DAY;
|
||||
datetime->usec = instant % USEC_PER_DAY;
|
||||
|
||||
- if (datetime->days < 1 || 3652059 < datetime->days)
|
||||
+ if (datetime->days < MIN_DAYS || datetime->days > MAX_DAYS)
|
||||
{
|
||||
g_date_time_unref (datetime);
|
||||
datetime = NULL;
|
||||
@@ -817,7 +820,7 @@ g_date_time_deal_with_date_change (GDateTime *datetime)
|
||||
gint64 full_time;
|
||||
gint64 usec;
|
||||
|
||||
- if (datetime->days < 1 || datetime->days > 3652059)
|
||||
+ if (datetime->days < MIN_DAYS || datetime->days > MAX_DAYS)
|
||||
return FALSE;
|
||||
|
||||
was_dst = g_time_zone_is_dst (datetime->tz, datetime->interval);
|
||||
|
||||
From 5f0c67435364fe682fe9dcc1d23645134a445a17 Mon Sep 17 00:00:00 2001
|
||||
From: Philip Withnall <pwithnall@gnome.org>
|
||||
Date: Sun, 29 Mar 2026 23:46:17 +0100
|
||||
Subject: [PATCH 2/2] gdatetime: Add missing range validation to
|
||||
g_date_time_add_full()
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
Otherwise it’s possible to create a non-`NULL` but invalid `GDateTime`,
|
||||
which breaks all kinds of internal assumptions.
|
||||
|
||||
Spotted by linhlhq as #YWH-PGM9867-191. Thanks to them for providing a
|
||||
suggested fix and a test case, which I have adapted and validated.
|
||||
|
||||
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
|
||||
|
||||
Fixes: #3917
|
||||
---
|
||||
glib/gdatetime.c | 4 +++-
|
||||
glib/tests/gdatetime.c | 18 ++++++++++++++++++
|
||||
2 files changed, 21 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/glib/gdatetime.c b/glib/gdatetime.c
|
||||
index 029636c08..883322891 100644
|
||||
--- a/glib/gdatetime.c
|
||||
+++ b/glib/gdatetime.c
|
||||
@@ -2022,7 +2022,9 @@ g_date_time_add_full (GDateTime *datetime,
|
||||
new->days = full_time / USEC_PER_DAY;
|
||||
new->usec = full_time % USEC_PER_DAY;
|
||||
|
||||
- /* XXX validate */
|
||||
+ /* Validate it’s still in the range 0001-01-01 to 9999-12-31 */
|
||||
+ if (new->days < MIN_DAYS || new->days > MAX_DAYS)
|
||||
+ g_clear_pointer (&new, g_date_time_unref);
|
||||
|
||||
return new;
|
||||
}
|
||||
diff --git a/glib/tests/gdatetime.c b/glib/tests/gdatetime.c
|
||||
index 12f332b44..88041a684 100644
|
||||
--- a/glib/tests/gdatetime.c
|
||||
+++ b/glib/tests/gdatetime.c
|
||||
@@ -1098,6 +1098,24 @@ test_GDateTime_add_full (void)
|
||||
TEST_ADD_FULL (2010, 8, 25, 22, 45, 0,
|
||||
0, 1, 6, 1, 25, 0,
|
||||
2010, 10, 2, 0, 10, 0);
|
||||
+
|
||||
+#define TEST_ADD_FULL_ERROR(y,m,d,h,mi,s,ay,am,ad,ah,ami,as) G_STMT_START { \
|
||||
+ GDateTime *dt; \
|
||||
+ dt = g_date_time_new_utc (y, m, d, h, mi, s); \
|
||||
+ g_assert_null (g_date_time_add_full (dt, ay, am, ad, ah, ami, as)); \
|
||||
+ g_date_time_unref (dt); \
|
||||
+} G_STMT_END
|
||||
+
|
||||
+ TEST_ADD_FULL_ERROR ( 1, 12, 1, 0, 0, 0,
|
||||
+ -1, 0, 0, 0, 0, 0);
|
||||
+ TEST_ADD_FULL_ERROR ( 1, 12, 1, 0, 0, 0,
|
||||
+ 10000, 0, 0, 0, 0, 0);
|
||||
+ TEST_ADD_FULL_ERROR ( 9999, 12, 1, 0, 0, 0,
|
||||
+ -10000, 0, 0, 0, 0, 0);
|
||||
+ TEST_ADD_FULL_ERROR ( 1, 12, 1, 0, 0, 0,
|
||||
+ 0, 0, 3660001, 0, 0, 0);
|
||||
+ TEST_ADD_FULL_ERROR ( 9999, 12, 1, 0, 0, 0,
|
||||
+ 0, 0, -3660001, 0, 0, 0);
|
||||
}
|
||||
|
||||
static void
|
||||
@ -5,7 +5,7 @@
|
||||
|
||||
Name: mingw-glib2
|
||||
Version: 2.70.1
|
||||
Release: 7%{?dist}
|
||||
Release: 8%{?dist}
|
||||
Summary: MinGW Windows GLib2 library
|
||||
|
||||
License: LGPLv2+
|
||||
@ -74,6 +74,9 @@ Patch7: mingw-glib2-2.70.1-CVE-2026-58012.patch
|
||||
# https://gitlab.gnome.org/GNOME/glib/-/work_items/3925
|
||||
Patch8: mingw-glib2-2.70.1-CVE-2026-58013.patch
|
||||
|
||||
# https://gitlab.gnome.org/GNOME/glib/-/issues/3917
|
||||
Patch9: mingw-glib2-2.70.1-CVE-2026-58011.patch
|
||||
|
||||
%description
|
||||
MinGW Windows Glib2 library.
|
||||
|
||||
@ -127,6 +130,7 @@ Static version of the MinGW Windows GLib2 library.
|
||||
%patch6 -p1
|
||||
%patch7 -p1
|
||||
%patch8 -p1
|
||||
%patch9 -p1
|
||||
|
||||
%build
|
||||
%mingw_meson --default-library=both \
|
||||
@ -304,6 +308,10 @@ find $RPM_BUILD_ROOT -name "*.la" -delete
|
||||
|
||||
|
||||
%changelog
|
||||
* Wed Jul 22 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.70.1-8
|
||||
- Fix CVE-2026-58011: g_date_time_add_full() range validation
|
||||
Resolves: RHEL-212184
|
||||
|
||||
* Wed Jul 22 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.70.1-7
|
||||
- Fix CVE-2026-58013: memcmp buffer over-read in giochannel
|
||||
Resolves: RHEL-212234
|
||||
|
||||
Loading…
Reference in New Issue
Block a user