diff --git a/CVE-2025-13601-gconvert-Error-out-if-g_escape_uri_string-would-overflow.patch b/CVE-2025-13601-gconvert-Error-out-if-g_escape_uri_string-would-overflow.patch new file mode 100644 index 0000000..b91820a --- /dev/null +++ b/CVE-2025-13601-gconvert-Error-out-if-g_escape_uri_string-would-overflow.patch @@ -0,0 +1,253 @@ +From f28340ee62c655487972ad3c632d231ee098fb7f Mon Sep 17 00:00:00 2001 +From: Philip Withnall +Date: Thu, 13 Nov 2025 18:27:22 +0000 +Subject: [PATCH 1/2] gconvert: Error out if g_escape_uri_string() would + overflow + +If the string to escape contains a very large number of unacceptable +characters (which would need escaping), the calculation of the length of +the escaped string could overflow, leading to a potential write off the +end of the newly allocated string. + +In addition to that, the number of unacceptable characters was counted +in a signed integer, which would overflow to become negative, making it +easier for an attacker to craft an input string which would cause an +out-of-bounds write. + +Fix that by validating the allocation length, and using an unsigned +integer to count the number of unacceptable characters. + +Spotted by treeplus. Thanks to the Sovereign Tech Resilience programme +from the Sovereign Tech Agency. ID: #YWH-PGM9867-134 + +Signed-off-by: Philip Withnall + +Fixes: #3827 +--- + glib/gconvert.c | 36 +++++++++++++++++++++++++----------- + 1 file changed, 25 insertions(+), 11 deletions(-) + +diff --git a/glib/gconvert.c b/glib/gconvert.c +index b066dd5a84..a02d2ea732 100644 +--- a/glib/gconvert.c ++++ b/glib/gconvert.c +@@ -1336,8 +1336,9 @@ static const gchar hex[] = "0123456789ABCDEF"; + /* Note: This escape function works on file: URIs, but if you want to + * escape something else, please read RFC-2396 */ + static gchar * +-g_escape_uri_string (const gchar *string, +- UnsafeCharacterSet mask) ++g_escape_uri_string (const gchar *string, ++ UnsafeCharacterSet mask, ++ GError **error) + { + #define ACCEPTABLE(a) ((a)>=32 && (a)<128 && (acceptable[(a)-32] & use_mask)) + +@@ -1345,7 +1346,7 @@ g_escape_uri_string (const gchar *string, + gchar *q; + gchar *result; + int c; +- gint unacceptable; ++ size_t unacceptable; + UnsafeCharacterSet use_mask; + + g_return_val_if_fail (mask == UNSAFE_ALL +@@ -1362,7 +1363,14 @@ g_escape_uri_string (const gchar *string, + if (!ACCEPTABLE (c)) + unacceptable++; + } +- ++ ++ if (unacceptable >= (G_MAXSIZE - (p - string)) / 2) ++ { ++ g_set_error_literal (error, G_CONVERT_ERROR, G_CONVERT_ERROR_BAD_URI, ++ _("The URI is too long")); ++ return NULL; ++ } ++ + result = g_malloc (p - string + unacceptable * 2 + 1); + + use_mask = mask; +@@ -1387,12 +1395,13 @@ g_escape_uri_string (const gchar *string, + + + static gchar * +-g_escape_file_uri (const gchar *hostname, +- const gchar *pathname) ++g_escape_file_uri (const gchar *hostname, ++ const gchar *pathname, ++ GError **error) + { + char *escaped_hostname = NULL; +- char *escaped_path; +- char *res; ++ char *escaped_path = NULL; ++ char *res = NULL; + + #ifdef G_OS_WIN32 + char *p, *backslash; +@@ -1413,10 +1422,14 @@ g_escape_file_uri (const gchar *hostname, + + if (hostname && *hostname != '\0') + { +- escaped_hostname = g_escape_uri_string (hostname, UNSAFE_HOST); ++ escaped_hostname = g_escape_uri_string (hostname, UNSAFE_HOST, error); ++ if (escaped_hostname == NULL) ++ goto out; + } + +- escaped_path = g_escape_uri_string (pathname, UNSAFE_PATH); ++ escaped_path = g_escape_uri_string (pathname, UNSAFE_PATH, error); ++ if (escaped_path == NULL) ++ goto out; + + res = g_strconcat ("file://", + (escaped_hostname) ? escaped_hostname : "", +@@ -1424,6 +1437,7 @@ g_escape_file_uri (const gchar *hostname, + escaped_path, + NULL); + ++out: + #ifdef G_OS_WIN32 + g_free ((char *) pathname); + #endif +@@ -1753,7 +1767,7 @@ g_filename_to_uri (const gchar *filename, + hostname = NULL; + #endif + +- escaped_uri = g_escape_file_uri (hostname, filename); ++ escaped_uri = g_escape_file_uri (hostname, filename, error); + + return escaped_uri; + } +-- +GitLab + + +From 7bd3fc372040cdf8eada7f65c32c30da52a7461d Mon Sep 17 00:00:00 2001 +From: Philip Withnall +Date: Thu, 13 Nov 2025 18:31:43 +0000 +Subject: [PATCH 2/2] fuzzing: Add fuzz tests for g_filename_{to,from}_uri() + +These functions could be called on untrusted input data, and since they +do URI escaping/unescaping, they have non-trivial string handling code. + +Signed-off-by: Philip Withnall + +See: #3827 +--- + fuzzing/fuzz_filename_from_uri.c | 40 ++++++++++++++++++++++++++++++++ + fuzzing/fuzz_filename_to_uri.c | 40 ++++++++++++++++++++++++++++++++ + fuzzing/meson.build | 2 ++ + 3 files changed, 82 insertions(+) + create mode 100644 fuzzing/fuzz_filename_from_uri.c + create mode 100644 fuzzing/fuzz_filename_to_uri.c + +diff --git a/fuzzing/fuzz_filename_from_uri.c b/fuzzing/fuzz_filename_from_uri.c +new file mode 100644 +index 0000000000..9b7a715f07 +--- /dev/null ++++ b/fuzzing/fuzz_filename_from_uri.c +@@ -0,0 +1,40 @@ ++/* ++ * Copyright 2025 GNOME Foundation, Inc. ++ * ++ * SPDX-License-Identifier: LGPL-2.1-or-later ++ * ++ * This library is free software; you can redistribute it and/or ++ * modify it under the terms of the GNU Lesser General Public ++ * License as published by the Free Software Foundation; either ++ * version 2.1 of the License, or (at your option) any later version. ++ * ++ * This library is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ * Lesser General Public License for more details. ++ * ++ * You should have received a copy of the GNU Lesser General Public ++ * License along with this library; if not, see . ++ */ ++ ++#include "fuzz.h" ++ ++int ++LLVMFuzzerTestOneInput (const unsigned char *data, size_t size) ++{ ++ unsigned char *nul_terminated_data = NULL; ++ char *filename = NULL; ++ GError *local_error = NULL; ++ ++ fuzz_set_logging_func (); ++ ++ /* ignore @size (g_filename_from_uri() doesn’t support it); ensure @data is nul-terminated */ ++ nul_terminated_data = (unsigned char *) g_strndup ((const char *) data, size); ++ filename = g_filename_from_uri ((const char *) nul_terminated_data, NULL, &local_error); ++ g_free (nul_terminated_data); ++ ++ g_free (filename); ++ g_clear_error (&local_error); ++ ++ return 0; ++} +diff --git a/fuzzing/fuzz_filename_to_uri.c b/fuzzing/fuzz_filename_to_uri.c +new file mode 100644 +index 0000000000..acb3192035 +--- /dev/null ++++ b/fuzzing/fuzz_filename_to_uri.c +@@ -0,0 +1,40 @@ ++/* ++ * Copyright 2025 GNOME Foundation, Inc. ++ * ++ * SPDX-License-Identifier: LGPL-2.1-or-later ++ * ++ * This library is free software; you can redistribute it and/or ++ * modify it under the terms of the GNU Lesser General Public ++ * License as published by the Free Software Foundation; either ++ * version 2.1 of the License, or (at your option) any later version. ++ * ++ * This library is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ * Lesser General Public License for more details. ++ * ++ * You should have received a copy of the GNU Lesser General Public ++ * License along with this library; if not, see . ++ */ ++ ++#include "fuzz.h" ++ ++int ++LLVMFuzzerTestOneInput (const unsigned char *data, size_t size) ++{ ++ unsigned char *nul_terminated_data = NULL; ++ char *uri = NULL; ++ GError *local_error = NULL; ++ ++ fuzz_set_logging_func (); ++ ++ /* ignore @size (g_filename_to_uri() doesn’t support it); ensure @data is nul-terminated */ ++ nul_terminated_data = (unsigned char *) g_strndup ((const char *) data, size); ++ uri = g_filename_to_uri ((const char *) nul_terminated_data, NULL, &local_error); ++ g_free (nul_terminated_data); ++ ++ g_free (uri); ++ g_clear_error (&local_error); ++ ++ return 0; ++} +diff --git a/fuzzing/meson.build b/fuzzing/meson.build +index addbe90717..05f936eeb2 100644 +--- a/fuzzing/meson.build ++++ b/fuzzing/meson.build +@@ -25,6 +25,8 @@ fuzz_targets = [ + 'fuzz_date_parse', + 'fuzz_date_time_new_from_iso8601', + 'fuzz_dbus_message', ++ 'fuzz_filename_from_uri', ++ 'fuzz_filename_to_uri', + 'fuzz_get_locale_variants', + 'fuzz_inet_address_mask_new_from_string', + 'fuzz_inet_address_new_from_string', +-- +GitLab + diff --git a/glib-prefer-constructors-over-DllMain.patch b/glib-prefer-constructors-over-DllMain.patch deleted file mode 100644 index 4e08af0..0000000 --- a/glib-prefer-constructors-over-DllMain.patch +++ /dev/null @@ -1,63 +0,0 @@ -diff -rupN --no-dereference glib-2.63.5/glib/glib-init.c glib-2.63.5-new/glib/glib-init.c ---- glib-2.63.5/glib/glib-init.c 2020-02-03 15:28:28.000000000 +0100 -+++ glib-2.63.5-new/glib/glib-init.c 2020-02-11 10:12:24.070832245 +0100 -@@ -271,12 +271,14 @@ glib_init (void) - - #if defined (G_OS_WIN32) - -+HMODULE glib_dll = NULL; -+ -+#if defined (DLL_EXPORT) -+ - BOOL WINAPI DllMain (HINSTANCE hinstDLL, - DWORD fdwReason, - LPVOID lpvReserved); - --HMODULE glib_dll; -- - BOOL WINAPI - DllMain (HINSTANCE hinstDLL, - DWORD fdwReason, -@@ -286,14 +288,6 @@ DllMain (HINSTANCE hinstDLL, - { - case DLL_PROCESS_ATTACH: - glib_dll = hinstDLL; -- g_crash_handler_win32_init (); -- g_clock_win32_init (); --#ifdef THREADS_WIN32 -- g_thread_win32_init (); --#endif -- glib_init (); -- /* must go after glib_init */ -- g_console_win32_init (); - break; - - case DLL_THREAD_DETACH: -@@ -318,7 +312,10 @@ DllMain (HINSTANCE hinstDLL, - return TRUE; - } - --#elif defined (G_HAS_CONSTRUCTORS) -+#endif /* defined (DLL_EXPORT) */ -+#endif /* defined (G_OS_WIN32) */ -+ -+#if defined (G_HAS_CONSTRUCTORS) - - #ifdef G_DEFINE_CONSTRUCTOR_NEEDS_PRAGMA - #pragma G_DEFINE_CONSTRUCTOR_PRAGMA_ARGS(glib_init_ctor) -@@ -328,7 +325,15 @@ G_DEFINE_CONSTRUCTOR(glib_init_ctor) - static void - glib_init_ctor (void) - { -+#if defined (G_OS_WIN32) -+ g_clock_win32_init (); -+#ifdef THREADS_WIN32 -+ g_thread_win32_init (); -+#endif /* defined (THREADS_WIN32) */ -+#endif /* defined (G_OS_WIN32) */ - glib_init (); -+ /* must go after glib_init */ -+ g_console_win32_init (); - } - - #else diff --git a/mingw-glib2.spec b/mingw-glib2.spec index 8d1f6bb..23d9a32 100644 --- a/mingw-glib2.spec +++ b/mingw-glib2.spec @@ -1,7 +1,7 @@ %{?mingw_package_header} Name: mingw-glib2 -Version: 2.82.2 +Version: 2.87.0 Release: 1%{?dist} Summary: MinGW Windows GLib2 library @@ -44,6 +44,11 @@ BuildRequires: python3-devel # https://bugzilla.gnome.org/show_bug.cgi?id=674214 Patch1: 0001-Use-CreateFile-on-Win32-to-make-sure-g_unlink-always.patch +# https://issues.redhat.com/browse/RHEL-130993 +# https://gitlab.gnome.org/GNOME/glib/-/issues/3827 +# https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4914 +Patch2: CVE-2025-13601-gconvert-Error-out-if-g_escape_uri_string-would-overflow.patch + # Prefer the use of GCC constructors over DllMain # This prevents having to depend on DllMain in static libraries # http://lists.fedoraproject.org/pipermail/mingw/2013-March/006429.html @@ -162,6 +167,10 @@ rm -f %{buildroot}%{mingw64_bindir}/gdbus-codegen rm -rf %{buildroot}%{mingw64_libdir}/gdbus-2.0 sed -i 's|gdbus_codegen=.*|gdbus_codegen=%{_bindir}/gdbus-codegen|g' %{buildroot}%{mingw64_libdir}/pkgconfig/gio-2.0.pc +# Delete installed tests +rm -rf %{buildroot}%{mingw32_libexecdir}/installed-tests/ +rm -rf %{buildroot}%{mingw64_libexecdir}/installed-tests/ + # Drop all .la files find %{buildroot} -name "*.la" -delete @@ -177,7 +186,7 @@ find %{buildroot} -name "*.la" -delete # Win32 %files -n mingw32-glib2 -f mingw32-glib20.lang -%license COPYING +%license LICENSES/LGPL-2.1-or-later.txt %{mingw32_bindir}/gdbus.exe %{mingw32_bindir}/gi-compile-repository.exe %{mingw32_bindir}/gi-decompile-typelib.exe @@ -235,7 +244,7 @@ find %{buildroot} -name "*.la" -delete # Win64 %files -n mingw64-glib2 -f mingw64-glib20.lang -%license COPYING +%license LICENSES/LGPL-2.1-or-later.txt %{mingw64_bindir}/gdbus.exe %{mingw64_bindir}/gi-compile-repository.exe %{mingw64_bindir}/gi-decompile-typelib.exe @@ -293,6 +302,10 @@ find %{buildroot} -name "*.la" -delete %changelog +* Mon Dec 1 2025 Konstantin Kostiuk - 2.87.0-1 +- Update to 2.87.0 +- RHEL-130993 - CVE-2025-13601 mingw-glib2: Integer overflow in in g_escape_uri_string() + * Mon Nov 25 2024 Konstantin Kostiuk - 2.82.2-1 - Update to 2.82.2 - RHEL-35772 - CVE-2024-34397 mingw-glib2: glib2: Signal subscription vulnerabilities diff --git a/sources b/sources index 99ee564..7e9f5fb 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (glib-2.82.2.tar.xz) = d5b761ec0c088496f2f9e5767568076a30ff492c272f21133560689f4e6a177d403c78d71ef85da63de331152c4d1f27b65d3e927ebfaf0fb63592f66e564ea1 +SHA512 (glib-2.87.0.tar.xz) = 07b58dc0bc395c6a53c9bc5d21674307ce9f0a836c82c04db5d5c3163685333f86ff237fc1cfde60daa10796d0de4c5ba90aa4bca056f4d670c73d97d0868b73