From 16e08b276e2910ac8ef4ffa64f199f9ad482f25c Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Wed, 22 Jul 2026 16:23:02 +0000 Subject: [PATCH] Fix CVE-2026-58011 in mingw-glib2: g_date_time_add_full() range validation Backport upstream fix for CVE-2026-58011 to mingw-glib2 2.70.1. Two upstream commits were cherry-picked and combined into a single patch (Patch3): - Factor out MIN_DAYS/MAX_DAYS magic constants in gdatetime.c - Add missing range validation to g_date_time_add_full() to prevent creation of invalid GDateTime objects, along with corresponding test cases. CVE: CVE-2026-58011 Upstream patches: - https://gitlab.gnome.org/GNOME/glib/-/commit/7f0f7d0870dad0dd0584c380fe699dfb5006db60.patch - https://gitlab.gnome.org/GNOME/glib/-/commit/ededb77ea01bfbb321402d85da4342af4379cfd4.patch Resolves: RHEL-212184 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- mingw-glib2-2.70.1-CVE-2026-58011.patch | 122 ++++++++++++++++++++++++ mingw-glib2.spec | 10 +- 2 files changed, 131 insertions(+), 1 deletion(-) create mode 100644 mingw-glib2-2.70.1-CVE-2026-58011.patch diff --git a/mingw-glib2-2.70.1-CVE-2026-58011.patch b/mingw-glib2-2.70.1-CVE-2026-58011.patch new file mode 100644 index 0000000..f91862a --- /dev/null +++ b/mingw-glib2-2.70.1-CVE-2026-58011.patch @@ -0,0 +1,122 @@ +From fbef21c7da7757239d6df411a24c7dbb345ab966 Mon Sep 17 00:00:00 2001 +From: Philip Withnall +Date: Sun, 29 Mar 2026 23:19:47 +0100 +Subject: [PATCH 1/2] gdatetime: Factor out a couple of magic constants + +This introduces no functional changes, it just makes the code a little +clearer. + +Signed-off-by: Philip Withnall +--- + glib/gdatetime.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/glib/gdatetime.c b/glib/gdatetime.c +index a31afe713..029636c08 100644 +--- a/glib/gdatetime.c ++++ b/glib/gdatetime.c +@@ -130,7 +130,7 @@ struct _GDateTime + gint interval; + + /* 1 is 0001-01-01 in Proleptic Gregorian */ +- gint32 days; ++ gint32 days; /* in range [MIN_DAYS, MAX_DAYS] */ + + gint ref_count; /* (atomic) */ + }; +@@ -172,6 +172,9 @@ struct _GDateTime + #define JULIAN_YEAR(d) ((d)->julian / 365.25) + #define DAYS_PER_PERIOD (G_GINT64_CONSTANT (2914695)) + ++#define MIN_DAYS 1 /* the days count for 0001-01-01 in Proleptic Gregorian */ ++#define MAX_DAYS 3652059 /* the days count for 9999-12-31 in Proleptic Gregorian */ ++ + static const guint16 days_in_months[2][13] = + { + { 0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 }, +@@ -781,7 +784,7 @@ g_date_time_from_instant (GTimeZone *tz, + datetime->days = instant / USEC_PER_DAY; + datetime->usec = instant % USEC_PER_DAY; + +- if (datetime->days < 1 || 3652059 < datetime->days) ++ if (datetime->days < MIN_DAYS || datetime->days > MAX_DAYS) + { + g_date_time_unref (datetime); + datetime = NULL; +@@ -817,7 +820,7 @@ g_date_time_deal_with_date_change (GDateTime *datetime) + gint64 full_time; + gint64 usec; + +- if (datetime->days < 1 || datetime->days > 3652059) ++ if (datetime->days < MIN_DAYS || datetime->days > MAX_DAYS) + return FALSE; + + was_dst = g_time_zone_is_dst (datetime->tz, datetime->interval); + +From 5f0c67435364fe682fe9dcc1d23645134a445a17 Mon Sep 17 00:00:00 2001 +From: Philip Withnall +Date: Sun, 29 Mar 2026 23:46:17 +0100 +Subject: [PATCH 2/2] gdatetime: Add missing range validation to + g_date_time_add_full() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Otherwise it’s possible to create a non-`NULL` but invalid `GDateTime`, +which breaks all kinds of internal assumptions. + +Spotted by linhlhq as #YWH-PGM9867-191. Thanks to them for providing a +suggested fix and a test case, which I have adapted and validated. + +Signed-off-by: Philip Withnall + +Fixes: #3917 +--- + glib/gdatetime.c | 4 +++- + glib/tests/gdatetime.c | 18 ++++++++++++++++++ + 2 files changed, 21 insertions(+), 1 deletion(-) + +diff --git a/glib/gdatetime.c b/glib/gdatetime.c +index 029636c08..883322891 100644 +--- a/glib/gdatetime.c ++++ b/glib/gdatetime.c +@@ -2022,7 +2022,9 @@ g_date_time_add_full (GDateTime *datetime, + new->days = full_time / USEC_PER_DAY; + new->usec = full_time % USEC_PER_DAY; + +- /* XXX validate */ ++ /* Validate it’s still in the range 0001-01-01 to 9999-12-31 */ ++ if (new->days < MIN_DAYS || new->days > MAX_DAYS) ++ g_clear_pointer (&new, g_date_time_unref); + + return new; + } +diff --git a/glib/tests/gdatetime.c b/glib/tests/gdatetime.c +index 12f332b44..88041a684 100644 +--- a/glib/tests/gdatetime.c ++++ b/glib/tests/gdatetime.c +@@ -1098,6 +1098,24 @@ test_GDateTime_add_full (void) + TEST_ADD_FULL (2010, 8, 25, 22, 45, 0, + 0, 1, 6, 1, 25, 0, + 2010, 10, 2, 0, 10, 0); ++ ++#define TEST_ADD_FULL_ERROR(y,m,d,h,mi,s,ay,am,ad,ah,ami,as) G_STMT_START { \ ++ GDateTime *dt; \ ++ dt = g_date_time_new_utc (y, m, d, h, mi, s); \ ++ g_assert_null (g_date_time_add_full (dt, ay, am, ad, ah, ami, as)); \ ++ g_date_time_unref (dt); \ ++} G_STMT_END ++ ++ TEST_ADD_FULL_ERROR ( 1, 12, 1, 0, 0, 0, ++ -1, 0, 0, 0, 0, 0); ++ TEST_ADD_FULL_ERROR ( 1, 12, 1, 0, 0, 0, ++ 10000, 0, 0, 0, 0, 0); ++ TEST_ADD_FULL_ERROR ( 9999, 12, 1, 0, 0, 0, ++ -10000, 0, 0, 0, 0, 0); ++ TEST_ADD_FULL_ERROR ( 1, 12, 1, 0, 0, 0, ++ 0, 0, 3660001, 0, 0, 0); ++ TEST_ADD_FULL_ERROR ( 9999, 12, 1, 0, 0, 0, ++ 0, 0, -3660001, 0, 0, 0); + } + + static void diff --git a/mingw-glib2.spec b/mingw-glib2.spec index d5b0c01..caabca2 100644 --- a/mingw-glib2.spec +++ b/mingw-glib2.spec @@ -5,7 +5,7 @@ Name: mingw-glib2 Version: 2.70.1 -Release: 7%{?dist} +Release: 8%{?dist} Summary: MinGW Windows GLib2 library License: LGPLv2+ @@ -74,6 +74,9 @@ Patch7: mingw-glib2-2.70.1-CVE-2026-58012.patch # https://gitlab.gnome.org/GNOME/glib/-/work_items/3925 Patch8: mingw-glib2-2.70.1-CVE-2026-58013.patch +# https://gitlab.gnome.org/GNOME/glib/-/issues/3917 +Patch9: mingw-glib2-2.70.1-CVE-2026-58011.patch + %description MinGW Windows Glib2 library. @@ -127,6 +130,7 @@ Static version of the MinGW Windows GLib2 library. %patch6 -p1 %patch7 -p1 %patch8 -p1 +%patch9 -p1 %build %mingw_meson --default-library=both \ @@ -304,6 +308,10 @@ find $RPM_BUILD_ROOT -name "*.la" -delete %changelog +* Wed Jul 22 2026 RHEL Packaging Agent - 2.70.1-8 +- Fix CVE-2026-58011: g_date_time_add_full() range validation + Resolves: RHEL-212184 + * Wed Jul 22 2026 RHEL Packaging Agent - 2.70.1-7 - Fix CVE-2026-58013: memcmp buffer over-read in giochannel Resolves: RHEL-212234