rpms/mingw-glib2
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Bump glib to 2.87.0

Browse Source 
Resolve: RHEL-130993 - CVE-2025-13601

Signed-off-by: Konstantin Kostiuk <kkostiuk@redhat.com>
This commit is contained in:
Konstantin Kostiuk 2025-12-01 13:51:01 +02:00
parent 9898a5a652
commit 83f9547200
4 changed files with 270 additions and 67 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

253
CVE-2025-13601-gconvert-Error-out-if-g_escape_uri_string-would-overflow.patch Normal file
View File

@ -0,0 +1,253 @@
From f28340ee62c655487972ad3c632d231ee098fb7f Mon Sep 17 00:00:00 2001
From: Philip Withnall <pwithnall@gnome.org>
Date: Thu, 13 Nov 2025 18:27:22 +0000
Subject: [PATCH 1/2] gconvert: Error out if g_escape_uri_string() would
overflow
If the string to escape contains a very large number of unacceptable
characters (which would need escaping), the calculation of the length of
the escaped string could overflow, leading to a potential write off the
end of the newly allocated string.
In addition to that, the number of unacceptable characters was counted
in a signed integer, which would overflow to become negative, making it
easier for an attacker to craft an input string which would cause an
out-of-bounds write.
Fix that by validating the allocation length, and using an unsigned
integer to count the number of unacceptable characters.
Spotted by treeplus. Thanks to the Sovereign Tech Resilience programme
from the Sovereign Tech Agency. ID: #YWH-PGM9867-134
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Fixes: #3827
---
glib/gconvert.c | 36 +++++++++++++++++++++++++-----------
1 file changed, 25 insertions(+), 11 deletions(-)
diff --git a/glib/gconvert.c b/glib/gconvert.c
index b066dd5a84..a02d2ea732 100644
--- a/glib/gconvert.c
+++ b/glib/gconvert.c
@@ -1336,8 +1336,9 @@ static const gchar hex[] = "0123456789ABCDEF";
/* Note: This escape function works on file: URIs, but if you want to
* escape something else, please read RFC-2396 */
static gchar *
-g_escape_uri_string (const gchar *string,
- UnsafeCharacterSet mask)
+g_escape_uri_string (const gchar *string,
+ UnsafeCharacterSet mask,
+ GError **error)
{
#define ACCEPTABLE(a) ((a)>=32 && (a)<128 && (acceptable[(a)-32] & use_mask))
@@ -1345,7 +1346,7 @@ g_escape_uri_string (const gchar *string,
gchar *q;
gchar *result;
int c;
- gint unacceptable;
+ size_t unacceptable;
UnsafeCharacterSet use_mask;
g_return_val_if_fail (mask == UNSAFE_ALL
@@ -1362,7 +1363,14 @@ g_escape_uri_string (const gchar *string,
if (!ACCEPTABLE (c))
unacceptable++;
}
-
+
+ if (unacceptable >= (G_MAXSIZE - (p - string)) / 2)
+ {
+ g_set_error_literal (error, G_CONVERT_ERROR, G_CONVERT_ERROR_BAD_URI,
+ _("The URI is too long"));
+ return NULL;
+ }
+
result = g_malloc (p - string + unacceptable * 2 + 1);
use_mask = mask;
@@ -1387,12 +1395,13 @@ g_escape_uri_string (const gchar *string,
static gchar *
-g_escape_file_uri (const gchar *hostname,
- const gchar *pathname)
+g_escape_file_uri (const gchar *hostname,
+ const gchar *pathname,
+ GError **error)
{
char *escaped_hostname = NULL;
- char *escaped_path;
- char *res;
+ char *escaped_path = NULL;
+ char *res = NULL;
#ifdef G_OS_WIN32
char *p, *backslash;
@@ -1413,10 +1422,14 @@ g_escape_file_uri (const gchar *hostname,
if (hostname && *hostname != '\0')
{
- escaped_hostname = g_escape_uri_string (hostname, UNSAFE_HOST);
+ escaped_hostname = g_escape_uri_string (hostname, UNSAFE_HOST, error);
+ if (escaped_hostname == NULL)
+ goto out;
}
- escaped_path = g_escape_uri_string (pathname, UNSAFE_PATH);
+ escaped_path = g_escape_uri_string (pathname, UNSAFE_PATH, error);
+ if (escaped_path == NULL)
+ goto out;
res = g_strconcat ("file://",
(escaped_hostname) ? escaped_hostname : "",
@@ -1424,6 +1437,7 @@ g_escape_file_uri (const gchar *hostname,
escaped_path,
NULL);
+out:
#ifdef G_OS_WIN32
g_free ((char *) pathname);
#endif
@@ -1753,7 +1767,7 @@ g_filename_to_uri (const gchar *filename,
hostname = NULL;
#endif
- escaped_uri = g_escape_file_uri (hostname, filename);
+ escaped_uri = g_escape_file_uri (hostname, filename, error);
return escaped_uri;
}
--
GitLab
From 7bd3fc372040cdf8eada7f65c32c30da52a7461d Mon Sep 17 00:00:00 2001
From: Philip Withnall <pwithnall@gnome.org>
Date: Thu, 13 Nov 2025 18:31:43 +0000
Subject: [PATCH 2/2] fuzzing: Add fuzz tests for g_filename_{to,from}_uri()
These functions could be called on untrusted input data, and since they
do URI escaping/unescaping, they have non-trivial string handling code.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
See: #3827
---
fuzzing/fuzz_filename_from_uri.c | 40 ++++++++++++++++++++++++++++++++
fuzzing/fuzz_filename_to_uri.c | 40 ++++++++++++++++++++++++++++++++
fuzzing/meson.build | 2 ++
3 files changed, 82 insertions(+)
create mode 100644 fuzzing/fuzz_filename_from_uri.c
create mode 100644 fuzzing/fuzz_filename_to_uri.c
diff --git a/fuzzing/fuzz_filename_from_uri.c b/fuzzing/fuzz_filename_from_uri.c
new file mode 100644
index 0000000000..9b7a715f07
--- /dev/null
+++ b/fuzzing/fuzz_filename_from_uri.c
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2025 GNOME Foundation, Inc.
+ *
+ * SPDX-License-Identifier: LGPL-2.1-or-later
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "fuzz.h"
+
+int
+LLVMFuzzerTestOneInput (const unsigned char *data, size_t size)
+{
+ unsigned char *nul_terminated_data = NULL;
+ char *filename = NULL;
+ GError *local_error = NULL;
+
+ fuzz_set_logging_func ();
+
+ /* ignore @size (g_filename_from_uri() doesn’t support it); ensure @data is nul-terminated */
+ nul_terminated_data = (unsigned char *) g_strndup ((const char *) data, size);
+ filename = g_filename_from_uri ((const char *) nul_terminated_data, NULL, &local_error);
+ g_free (nul_terminated_data);
+
+ g_free (filename);
+ g_clear_error (&local_error);
+
+ return 0;
+}
diff --git a/fuzzing/fuzz_filename_to_uri.c b/fuzzing/fuzz_filename_to_uri.c
new file mode 100644
index 0000000000..acb3192035
--- /dev/null
+++ b/fuzzing/fuzz_filename_to_uri.c
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2025 GNOME Foundation, Inc.
+ *
+ * SPDX-License-Identifier: LGPL-2.1-or-later
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "fuzz.h"
+
+int
+LLVMFuzzerTestOneInput (const unsigned char *data, size_t size)
+{
+ unsigned char *nul_terminated_data = NULL;
+ char *uri = NULL;
+ GError *local_error = NULL;
+
+ fuzz_set_logging_func ();
+
+ /* ignore @size (g_filename_to_uri() doesn’t support it); ensure @data is nul-terminated */
+ nul_terminated_data = (unsigned char *) g_strndup ((const char *) data, size);
+ uri = g_filename_to_uri ((const char *) nul_terminated_data, NULL, &local_error);
+ g_free (nul_terminated_data);
+
+ g_free (uri);
+ g_clear_error (&local_error);
+
+ return 0;
+}
diff --git a/fuzzing/meson.build b/fuzzing/meson.build
index addbe90717..05f936eeb2 100644
--- a/fuzzing/meson.build
+++ b/fuzzing/meson.build
@@ -25,6 +25,8 @@ fuzz_targets = [
'fuzz_date_parse',
'fuzz_date_time_new_from_iso8601',
'fuzz_dbus_message',
+ 'fuzz_filename_from_uri',
+ 'fuzz_filename_to_uri',
'fuzz_get_locale_variants',
'fuzz_inet_address_mask_new_from_string',
'fuzz_inet_address_new_from_string',
--
GitLab

63
glib-prefer-constructors-over-DllMain.patch
View File

@ -1,63 +0,0 @@
diff -rupN --no-dereference glib-2.63.5/glib/glib-init.c glib-2.63.5-new/glib/glib-init.c
--- glib-2.63.5/glib/glib-init.c 2020-02-03 15:28:28.000000000 +0100
+++ glib-2.63.5-new/glib/glib-init.c 2020-02-11 10:12:24.070832245 +0100
@@ -271,12 +271,14 @@ glib_init (void)
#if defined (G_OS_WIN32)
+HMODULE glib_dll = NULL;
+
+#if defined (DLL_EXPORT)
+
BOOL WINAPI DllMain (HINSTANCE hinstDLL,
DWORD fdwReason,
LPVOID lpvReserved);
-HMODULE glib_dll;
-
BOOL WINAPI
DllMain (HINSTANCE hinstDLL,
DWORD fdwReason,
@@ -286,14 +288,6 @@ DllMain (HINSTANCE hinstDLL,
{
case DLL_PROCESS_ATTACH:
glib_dll = hinstDLL;
- g_crash_handler_win32_init ();
- g_clock_win32_init ();
-#ifdef THREADS_WIN32
- g_thread_win32_init ();
-#endif
- glib_init ();
- /* must go after glib_init */
- g_console_win32_init ();
break;
case DLL_THREAD_DETACH:
@@ -318,7 +312,10 @@ DllMain (HINSTANCE hinstDLL,
return TRUE;
}
-#elif defined (G_HAS_CONSTRUCTORS)
+#endif /* defined (DLL_EXPORT) */
+#endif /* defined (G_OS_WIN32) */
+
+#if defined (G_HAS_CONSTRUCTORS)
#ifdef G_DEFINE_CONSTRUCTOR_NEEDS_PRAGMA
#pragma G_DEFINE_CONSTRUCTOR_PRAGMA_ARGS(glib_init_ctor)
@@ -328,7 +325,15 @@ G_DEFINE_CONSTRUCTOR(glib_init_ctor)
static void
glib_init_ctor (void)
{
+#if defined (G_OS_WIN32)
+ g_clock_win32_init ();
+#ifdef THREADS_WIN32
+ g_thread_win32_init ();
+#endif /* defined (THREADS_WIN32) */
+#endif /* defined (G_OS_WIN32) */
glib_init ();
+ /* must go after glib_init */
+ g_console_win32_init ();
}
#else

19
mingw-glib2.spec
View File

@ -1,7 +1,7 @@
%{?mingw_package_header}
Name: mingw-glib2
Version: 2.82.2
Version: 2.87.0
Release: 1%{?dist}
Summary: MinGW Windows GLib2 library
@ -44,6 +44,11 @@ BuildRequires: python3-devel
# https://bugzilla.gnome.org/show_bug.cgi?id=674214
Patch1: 0001-Use-CreateFile-on-Win32-to-make-sure-g_unlink-always.patch
# https://issues.redhat.com/browse/RHEL-130993
# https://gitlab.gnome.org/GNOME/glib/-/issues/3827
# https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4914
Patch2: CVE-2025-13601-gconvert-Error-out-if-g_escape_uri_string-would-overflow.patch
# Prefer the use of GCC constructors over DllMain
# This prevents having to depend on DllMain in static libraries
# http://lists.fedoraproject.org/pipermail/mingw/2013-March/006429.html
@ -162,6 +167,10 @@ rm -f %{buildroot}%{mingw64_bindir}/gdbus-codegen
rm -rf %{buildroot}%{mingw64_libdir}/gdbus-2.0
sed -i 's|gdbus_codegen=.*|gdbus_codegen=%{_bindir}/gdbus-codegen|g' %{buildroot}%{mingw64_libdir}/pkgconfig/gio-2.0.pc
# Delete installed tests
rm -rf %{buildroot}%{mingw32_libexecdir}/installed-tests/
rm -rf %{buildroot}%{mingw64_libexecdir}/installed-tests/
# Drop all .la files
find %{buildroot} -name "*.la" -delete
@ -177,7 +186,7 @@ find %{buildroot} -name "*.la" -delete
# Win32
%files -n mingw32-glib2 -f mingw32-glib20.lang
%license COPYING
%license LICENSES/LGPL-2.1-or-later.txt
%{mingw32_bindir}/gdbus.exe
%{mingw32_bindir}/gi-compile-repository.exe
%{mingw32_bindir}/gi-decompile-typelib.exe
@ -235,7 +244,7 @@ find %{buildroot} -name "*.la" -delete
# Win64
%files -n mingw64-glib2 -f mingw64-glib20.lang
%license COPYING
%license LICENSES/LGPL-2.1-or-later.txt
%{mingw64_bindir}/gdbus.exe
%{mingw64_bindir}/gi-compile-repository.exe
%{mingw64_bindir}/gi-decompile-typelib.exe
@ -293,6 +302,10 @@ find %{buildroot} -name "*.la" -delete
%changelog
* Mon Dec 1 2025 Konstantin Kostiuk <kkostiuk@redhat.com> - 2.87.0-1
- Update to 2.87.0
- RHEL-130993 - CVE-2025-13601 mingw-glib2: Integer overflow in in g_escape_uri_string()
* Mon Nov 25 2024 Konstantin Kostiuk <kkostiuk@redhat.com> - 2.82.2-1
- Update to 2.82.2
- RHEL-35772 - CVE-2024-34397 mingw-glib2: glib2: Signal subscription vulnerabilities

2
sources
View File

@ -1 +1 @@
SHA512 (glib-2.82.2.tar.xz) = d5b761ec0c088496f2f9e5767568076a30ff492c272f21133560689f4e6a177d403c78d71ef85da63de331152c4d1f27b65d3e927ebfaf0fb63592f66e564ea1
SHA512 (glib-2.87.0.tar.xz) = 07b58dc0bc395c6a53c9bc5d21674307ce9f0a836c82c04db5d5c3163685333f86ff237fc1cfde60daa10796d0de4c5ba90aa4bca056f4d670c73d97d0868b73