Fix CVE-2026-58016: D-Bus introspection XML node nesting check
Backport upstream commit c9da977c178f to fix CVE-2026-58016. The patch corrects a broken nesting check for `<node>` elements in the D-Bus introspection XML parser (gio/gdbusintrospection.c) and adds unit tests for invalid XML parsing (gio/tests/gdbus-introspection.c). CVE: CVE-2026-58016 Upstream patches: - https://github.com/GNOME/glib/commit/c9da977c178f.patch Resolves: RHEL-190617 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent
parent
32d8cd1f1f
commit
bb8e441cea
87
mingw-glib2-2.70.1-CVE-2026-58016.patch
Normal file
87
mingw-glib2-2.70.1-CVE-2026-58016.patch
Normal file
@ -0,0 +1,87 @@
|
||||
From 0cf6b5ef06f44a4b259a014870cdc02780cc8ba4 Mon Sep 17 00:00:00 2001
|
||||
From: Philip Withnall <pwithnall@gnome.org>
|
||||
Date: Thu, 16 Apr 2026 15:27:37 +0100
|
||||
Subject: [PATCH] gdbusintrospection: Fix XML parser state handling for <node>
|
||||
element nesting
|
||||
|
||||
The check for whether a `<node>` element in D-Bus introspection XML was
|
||||
nested correctly was broken. `<node>` elements can only be at the top
|
||||
level, or nested immediately within another `<node>` element.
|
||||
|
||||
Fix the check and add some unit tests for it.
|
||||
|
||||
Spotted by linhlhq as #YWH-PGM9867-204. The fix is mine, and the unit test
|
||||
uses example XML strings adapted from their report.
|
||||
|
||||
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
|
||||
|
||||
Fixes: #3932
|
||||
---
|
||||
gio/gdbusintrospection.c | 2 +-
|
||||
gio/tests/gdbus-introspection.c | 33 +++++++++++++++++++++++++++++++++
|
||||
2 files changed, 34 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/gio/gdbusintrospection.c b/gio/gdbusintrospection.c
|
||||
index d6aa445d5..1e0cb81de 100644
|
||||
--- a/gio/gdbusintrospection.c
|
||||
+++ b/gio/gdbusintrospection.c
|
||||
@@ -1270,7 +1270,7 @@ parser_start_element (GMarkupParseContext *context,
|
||||
/* ---------------------------------------------------------------------------------------------------- */
|
||||
if (strcmp (element_name, "node") == 0)
|
||||
{
|
||||
- if (!(g_slist_length (stack) >= 1 || strcmp (stack->next->data, "node") != 0))
|
||||
+ if (stack->next != NULL && strcmp (stack->next->data, "node") != 0)
|
||||
{
|
||||
g_set_error_literal (error,
|
||||
G_MARKUP_ERROR,
|
||||
diff --git a/gio/tests/gdbus-introspection.c b/gio/tests/gdbus-introspection.c
|
||||
index 50c0cc721..e2cdf0a25 100644
|
||||
--- a/gio/tests/gdbus-introspection.c
|
||||
+++ b/gio/tests/gdbus-introspection.c
|
||||
@@ -297,6 +297,38 @@ test_extra_data (void)
|
||||
g_dbus_node_info_unref (info);
|
||||
}
|
||||
|
||||
+static void
|
||||
+test_invalid (void)
|
||||
+{
|
||||
+ const struct
|
||||
+ {
|
||||
+ const char *xml;
|
||||
+ GMarkupError expected_error_code;
|
||||
+ }
|
||||
+ vectors[] =
|
||||
+ {
|
||||
+ { "", G_MARKUP_ERROR_EMPTY },
|
||||
+ { "<node><interface name=\"I\"><method name=\"M\"><node><interface name=\"I2\"></interface></node></method>", G_MARKUP_ERROR_INVALID_CONTENT },
|
||||
+ { "<node><interface name=\"I\"><signal name=\"S\"><node><interface name=\"I2\"><signal name=\"S2\"></signal></interface></node></signal>", G_MARKUP_ERROR_INVALID_CONTENT },
|
||||
+ { "<node><interface name=\"I\"><property name=\"P\" type=\"s\" access=\"read\"><node><interface name=\"I2\"></interface></node></property>", G_MARKUP_ERROR_INVALID_CONTENT },
|
||||
+ { "<node><interface name=\"I\"><method name=\"M\"><arg type=\"\"><node><interface name=\"I2\"><method name=\"M2\"></method></interface></node></arg>", G_MARKUP_ERROR_INVALID_CONTENT },
|
||||
+ };
|
||||
+
|
||||
+ for (size_t i = 0; i < G_N_ELEMENTS (vectors); i++)
|
||||
+ {
|
||||
+ GDBusNodeInfo *node;
|
||||
+ GError *local_error = NULL;
|
||||
+
|
||||
+ g_test_message ("Testing parsing of %s gives an error", vectors[i].xml);
|
||||
+
|
||||
+ node = g_dbus_node_info_new_for_xml (vectors[i].xml, &local_error);
|
||||
+ g_assert_error (local_error, G_MARKUP_ERROR, (int) vectors[i].expected_error_code);
|
||||
+ g_assert_null (node);
|
||||
+
|
||||
+ g_clear_error (&local_error);
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
/* ---------------------------------------------------------------------------------------------------- */
|
||||
|
||||
int
|
||||
@@ -314,6 +346,7 @@ main (int argc,
|
||||
g_test_add_func ("/gdbus/introspection-generate", test_generate);
|
||||
g_test_add_func ("/gdbus/introspection-default-direction", test_default_direction);
|
||||
g_test_add_func ("/gdbus/introspection-extra-data", test_extra_data);
|
||||
+ g_test_add_func ("/gdbus/introspection-invalid", test_invalid);
|
||||
|
||||
ret = session_bus_run ();
|
||||
|
||||
@ -5,7 +5,7 @@
|
||||
|
||||
Name: mingw-glib2
|
||||
Version: 2.70.1
|
||||
Release: 3%{?dist}
|
||||
Release: 4%{?dist}
|
||||
Summary: MinGW Windows GLib2 library
|
||||
|
||||
License: LGPLv2+
|
||||
@ -62,6 +62,9 @@ Patch3: mingw-glib2-2.70.1-CVE-2026-58015.patch
|
||||
# https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5171
|
||||
Patch4: mingw-glib2-2.70.1-CVE-2026-58014.patch
|
||||
|
||||
# https://github.com/GNOME/glib/commit/c9da977c178f
|
||||
Patch5: mingw-glib2-2.70.1-CVE-2026-58016.patch
|
||||
|
||||
%description
|
||||
MinGW Windows Glib2 library.
|
||||
|
||||
@ -111,6 +114,7 @@ Static version of the MinGW Windows GLib2 library.
|
||||
%patch2 -p1
|
||||
%patch3 -p1
|
||||
%patch4 -p1
|
||||
%patch5 -p1
|
||||
|
||||
%build
|
||||
%mingw_meson --default-library=both \
|
||||
@ -288,6 +292,10 @@ find $RPM_BUILD_ROOT -name "*.la" -delete
|
||||
|
||||
|
||||
%changelog
|
||||
* Wed Jul 22 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.70.1-4
|
||||
- Fix CVE-2026-58016: D-Bus introspection XML node nesting check
|
||||
Resolves: RHEL-190617
|
||||
|
||||
* Wed Jul 22 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.70.1-3
|
||||
- Fix CVE-2026-58014: one-byte heap under-read in mingw-glib2
|
||||
Resolves: RHEL-190609
|
||||
|
||||
Loading…
Reference in New Issue
Block a user