Fix CVE-2026-58014: one-byte heap under-read in mingw-glib2

Backport upstream fix for CVE-2026-58014 from GitLab MR !5171
(commit 5f6d86b5) to mingw-glib2 2.70.1. The patch fixes a
one-byte heap under-read in g_key_file_get_locale_string_list()
when called on a key with an empty value (len == 0). The fix
adds a `len > 0` guard in glib/gkeyfile.c. The patch also
includes a fuzzing test extension and a unit test.

CVE: CVE-2026-58014
Upstream patches:
 - https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5171.patch
Resolves: RHEL-190609

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir

mingw-glib2-2.70.1-CVE-2026-58014.patch

@@ -0,0 +1,101 @@
+From 8e49ae633b6eaceff9881ea15c8bb48cf11c8a53 Mon Sep 17 00:00:00 2001
+From: Philip Withnall <pwithnall@gnome.org>
+Date: Sat, 11 Apr 2026 14:42:57 +0100
+Subject: [PATCH] gkeyfile: Fix a one-byte heap under-read with
+ g_key_file_get_locale_string_list()
+
+If this method was called on a key file key which has an empty value,
+`len == 0` and this leads to a one-byte under-read off the start of the
+key file buffer.
+
+Spotted by linhlhq as #YWH-PGM9867-200. The suggested fix is theirs, and
+the unit test is adapted from their report. I added the fuzzing test.
+
+Signed-off-by: Philip Withnall <pwithnall@gnome.org>
+
+Fixes: #3930
+---
+ fuzzing/fuzz_key.c   |  9 +++++++++
+ glib/gkeyfile.c      |  2 +-
+ glib/tests/keyfile.c | 23 +++++++++++++++++++++++
+ 3 files changed, 33 insertions(+), 1 deletion(-)
+
+diff --git a/fuzzing/fuzz_key.c b/fuzzing/fuzz_key.c
+index 9f1f9187e..285bad26f 100644
+--- a/fuzzing/fuzz_key.c
++++ b/fuzzing/fuzz_key.c
+@@ -6,11 +6,20 @@ test_parse (const gchar   *data,
+             GKeyFileFlags  flags)
+ {
+   GKeyFile *key = NULL;
++  char *comment = NULL;
++  char **list = NULL;
+ 
+   key = g_key_file_new ();
+   g_key_file_load_from_data (key, (const gchar*) data, size, G_KEY_FILE_NONE,
+                              NULL);
+ 
++  /* Also try some additional parsing and see if it crashes */
++  comment = g_key_file_get_comment (key, "group", "key", NULL);
++  g_free (comment);
++
++  list = g_key_file_get_locale_string_list (key, "group", "key", "de", NULL, NULL);
++  g_strfreev (list);
++
+   g_key_file_free (key);
+ }
+ 
+diff --git a/glib/gkeyfile.c b/glib/gkeyfile.c
+index 17cf85660..76459daab 100644
+--- a/glib/gkeyfile.c
++++ b/glib/gkeyfile.c
+@@ -2407,7 +2407,7 @@ g_key_file_get_locale_string_list (GKeyFile     *key_file,
+     }
+ 
+   len = strlen (value);
+-  if (value[len - 1] == key_file->list_separator)
++  if (len > 0 && value[len - 1] == key_file->list_separator)
+     value[len - 1] = '\0';
+ 
+   list_separator[0] = key_file->list_separator;
+diff --git a/glib/tests/keyfile.c b/glib/tests/keyfile.c
+index 1f5be8b38..17724bc15 100644
+--- a/glib/tests/keyfile.c
++++ b/glib/tests/keyfile.c
+@@ -800,6 +800,28 @@ test_locale_string_multiple_loads (void)
+   g_free (old_locale);
+ }
+ 
++static void
++test_locale_string_empty (void)
++{
++  GKeyFile *keyfile = NULL;
++  GError *local_error = NULL;
++  const char *data =
++    "[valid]\n"
++    "key1=\n";
++
++  g_test_summary ("Check that loading an empty translatable string works");
++  g_test_bug ("https://gitlab.gnome.org/GNOME/glib/-/issues/3930");
++
++  keyfile = g_key_file_new ();
++
++  g_key_file_load_from_data (keyfile, data, -1, G_KEY_FILE_NONE, &local_error);
++  g_assert_no_error (local_error);
++
++  check_locale_string_list_value (keyfile, "valid", "key1", NULL, NULL);
++
++  g_key_file_free (keyfile);
++}
++
+ static void
+ test_lists (void)
+ {
+@@ -1832,6 +1854,7 @@ main (int argc, char *argv[])
+   g_test_add_func ("/keyfile/number", test_number);
+   g_test_add_func ("/keyfile/locale-string", test_locale_string);
+   g_test_add_func ("/keyfile/locale-string/multiple-loads", test_locale_string_multiple_loads);
++  g_test_add_func ("/keyfile/locale-string/empty", test_locale_string_empty);
+   g_test_add_func ("/keyfile/lists", test_lists);
+   g_test_add_func ("/keyfile/lists-set-get", test_lists_set_get);
+   g_test_add_func ("/keyfile/group-remove", test_group_remove);

mingw-glib2.spec

@@ -5,7 +5,7 @@
 
 Name:           mingw-glib2
 Version:        2.70.1
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        MinGW Windows GLib2 library
 
 License:        LGPLv2+
@@ -58,6 +58,10 @@ Patch2:         glib-prefer-constructors-over-DllMain.patch
 # https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5172
 Patch3:         mingw-glib2-2.70.1-CVE-2026-58015.patch
 
+# CVE-2026-58014: one-byte heap under-read with g_key_file_get_locale_string_list()
+# https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5171
+Patch4:         mingw-glib2-2.70.1-CVE-2026-58014.patch
+
 %description
 MinGW Windows Glib2 library.
 
@@ -106,6 +110,7 @@ Static version of the MinGW Windows GLib2 library.
 %patch1 -p1
 %patch2 -p1
 %patch3 -p1
+%patch4 -p1
 
 %build
 %mingw_meson --default-library=both \
@@ -283,6 +288,10 @@ find $RPM_BUILD_ROOT -name "*.la" -delete
 
 
 %changelog
+* Wed Jul 22 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.70.1-3
+- Fix CVE-2026-58014: one-byte heap under-read in mingw-glib2
+  Resolves: RHEL-190609
+
 * Mon Jul 20 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.70.1-2
 - Fix CVE-2026-58015: D-Bus cookie context path traversal
   Resolves: RHEL-212246