From bb8e441ceae03f09cffd399da2a66719a8b1f773 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Wed, 22 Jul 2026 15:56:28 +0000 Subject: [PATCH] Fix CVE-2026-58016: D-Bus introspection XML node nesting check Backport upstream commit c9da977c178f to fix CVE-2026-58016. The patch corrects a broken nesting check for `` elements in the D-Bus introspection XML parser (gio/gdbusintrospection.c) and adds unit tests for invalid XML parsing (gio/tests/gdbus-introspection.c). CVE: CVE-2026-58016 Upstream patches: - https://github.com/GNOME/glib/commit/c9da977c178f.patch Resolves: RHEL-190617 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- mingw-glib2-2.70.1-CVE-2026-58016.patch | 87 +++++++++++++++++++++++++ mingw-glib2.spec | 10 ++- 2 files changed, 96 insertions(+), 1 deletion(-) create mode 100644 mingw-glib2-2.70.1-CVE-2026-58016.patch diff --git a/mingw-glib2-2.70.1-CVE-2026-58016.patch b/mingw-glib2-2.70.1-CVE-2026-58016.patch new file mode 100644 index 0000000..c045ed5 --- /dev/null +++ b/mingw-glib2-2.70.1-CVE-2026-58016.patch @@ -0,0 +1,87 @@ +From 0cf6b5ef06f44a4b259a014870cdc02780cc8ba4 Mon Sep 17 00:00:00 2001 +From: Philip Withnall +Date: Thu, 16 Apr 2026 15:27:37 +0100 +Subject: [PATCH] gdbusintrospection: Fix XML parser state handling for + element nesting + +The check for whether a `` element in D-Bus introspection XML was +nested correctly was broken. `` elements can only be at the top +level, or nested immediately within another `` element. + +Fix the check and add some unit tests for it. + +Spotted by linhlhq as #YWH-PGM9867-204. The fix is mine, and the unit test +uses example XML strings adapted from their report. + +Signed-off-by: Philip Withnall + +Fixes: #3932 +--- + gio/gdbusintrospection.c | 2 +- + gio/tests/gdbus-introspection.c | 33 +++++++++++++++++++++++++++++++++ + 2 files changed, 34 insertions(+), 1 deletion(-) + +diff --git a/gio/gdbusintrospection.c b/gio/gdbusintrospection.c +index d6aa445d5..1e0cb81de 100644 +--- a/gio/gdbusintrospection.c ++++ b/gio/gdbusintrospection.c +@@ -1270,7 +1270,7 @@ parser_start_element (GMarkupParseContext *context, + /* ---------------------------------------------------------------------------------------------------- */ + if (strcmp (element_name, "node") == 0) + { +- if (!(g_slist_length (stack) >= 1 || strcmp (stack->next->data, "node") != 0)) ++ if (stack->next != NULL && strcmp (stack->next->data, "node") != 0) + { + g_set_error_literal (error, + G_MARKUP_ERROR, +diff --git a/gio/tests/gdbus-introspection.c b/gio/tests/gdbus-introspection.c +index 50c0cc721..e2cdf0a25 100644 +--- a/gio/tests/gdbus-introspection.c ++++ b/gio/tests/gdbus-introspection.c +@@ -297,6 +297,38 @@ test_extra_data (void) + g_dbus_node_info_unref (info); + } + ++static void ++test_invalid (void) ++{ ++ const struct ++ { ++ const char *xml; ++ GMarkupError expected_error_code; ++ } ++ vectors[] = ++ { ++ { "", G_MARKUP_ERROR_EMPTY }, ++ { "", G_MARKUP_ERROR_INVALID_CONTENT }, ++ { "", G_MARKUP_ERROR_INVALID_CONTENT }, ++ { "", G_MARKUP_ERROR_INVALID_CONTENT }, ++ { "", G_MARKUP_ERROR_INVALID_CONTENT }, ++ }; ++ ++ for (size_t i = 0; i < G_N_ELEMENTS (vectors); i++) ++ { ++ GDBusNodeInfo *node; ++ GError *local_error = NULL; ++ ++ g_test_message ("Testing parsing of %s gives an error", vectors[i].xml); ++ ++ node = g_dbus_node_info_new_for_xml (vectors[i].xml, &local_error); ++ g_assert_error (local_error, G_MARKUP_ERROR, (int) vectors[i].expected_error_code); ++ g_assert_null (node); ++ ++ g_clear_error (&local_error); ++ } ++} ++ + /* ---------------------------------------------------------------------------------------------------- */ + + int +@@ -314,6 +346,7 @@ main (int argc, + g_test_add_func ("/gdbus/introspection-generate", test_generate); + g_test_add_func ("/gdbus/introspection-default-direction", test_default_direction); + g_test_add_func ("/gdbus/introspection-extra-data", test_extra_data); ++ g_test_add_func ("/gdbus/introspection-invalid", test_invalid); + + ret = session_bus_run (); + diff --git a/mingw-glib2.spec b/mingw-glib2.spec index 3cb2f83..a726bd6 100644 --- a/mingw-glib2.spec +++ b/mingw-glib2.spec @@ -5,7 +5,7 @@ Name: mingw-glib2 Version: 2.70.1 -Release: 3%{?dist} +Release: 4%{?dist} Summary: MinGW Windows GLib2 library License: LGPLv2+ @@ -62,6 +62,9 @@ Patch3: mingw-glib2-2.70.1-CVE-2026-58015.patch # https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5171 Patch4: mingw-glib2-2.70.1-CVE-2026-58014.patch +# https://github.com/GNOME/glib/commit/c9da977c178f +Patch5: mingw-glib2-2.70.1-CVE-2026-58016.patch + %description MinGW Windows Glib2 library. @@ -111,6 +114,7 @@ Static version of the MinGW Windows GLib2 library. %patch2 -p1 %patch3 -p1 %patch4 -p1 +%patch5 -p1 %build %mingw_meson --default-library=both \ @@ -288,6 +292,10 @@ find $RPM_BUILD_ROOT -name "*.la" -delete %changelog +* Wed Jul 22 2026 RHEL Packaging Agent - 2.70.1-4 +- Fix CVE-2026-58016: D-Bus introspection XML node nesting check + Resolves: RHEL-190617 + * Wed Jul 22 2026 RHEL Packaging Agent - 2.70.1-3 - Fix CVE-2026-58014: one-byte heap under-read in mingw-glib2 Resolves: RHEL-190609