rpms/mingw-glib2
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2025-14087: integer overflow in GVariant parser

Browse Source 
Backport upstream commit 31f82e22 to fix CVE-2025-14087 in
mingw-glib2. The patch changes loop counter types from `int` to
`size_t` in glib/gvariant-parser.c to prevent potential integer
overflow when parsing string and bytestring literals longer than
INT_MAX in GVariant text format input.

CVE: CVE-2025-14087
Upstream patches:
 - 31f82e22e2.patch
Resolves: RHEL-154707

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-07-22 15:57:58 +00:00
parent bb8e441cea
commit d9b6761028
2 changed files with 74 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

65
mingw-glib2-2.70.1-CVE-2025-14087.patch Normal file
View File

@ -0,0 +1,65 @@
From 074d82962028125c7886e5edcff1a58a508e0e61 Mon Sep 17 00:00:00 2001
From: Philip Withnall <pwithnall@gnome.org>
Date: Tue, 25 Nov 2025 19:02:56 +0000
Subject: [PATCH] gvariant-parser: Fix potential integer overflow parsing
(byte)strings
The termination condition for parsing string and bytestring literals in
GVariant text format input was subject to an integer overflow for input
string (or bytestring) literals longer than `INT_MAX`.
Fix that by counting as a `size_t` rather than as an `int`. The counter
can never correctly be negative.
Spotted by treeplus. Thanks to the Sovereign Tech Resilience programme
from the Sovereign Tech Agency. ID: #YWH-PGM9867-145
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Fixes: #3834
---
glib/gvariant-parser.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/glib/gvariant-parser.c b/glib/gvariant-parser.c
index bb5238bea..af6527d40 100644
--- a/glib/gvariant-parser.c
+++ b/glib/gvariant-parser.c
@@ -594,7 +594,7 @@ ast_resolve (AST *ast,
{
GVariant *value;
gchar *pattern;
- gint i, j = 0;
+ size_t i, j = 0;
pattern = ast_get_pattern (ast, error);
@@ -1555,9 +1555,9 @@ string_free (AST *ast)
* No leading/trailing space allowed. */
static gboolean
unicode_unescape (const gchar *src,
- gint *src_ofs,
+ size_t *src_ofs,
gchar *dest,
- gint *dest_ofs,
+ size_t *dest_ofs,
gsize length,
SourceRef *ref,
GError **error)
@@ -1618,7 +1618,7 @@ string_parse (TokenStream *stream,
gsize length;
gchar quote;
gchar *str;
- gint i, j;
+ size_t i, j;
token_stream_start_ref (stream, &ref);
token = token_stream_get (stream);
@@ -1748,7 +1748,7 @@ bytestring_parse (TokenStream *stream,
gsize length;
gchar quote;
gchar *str;
- gint i, j;
+ size_t i, j;
token_stream_start_ref (stream, &ref);
token = token_stream_get (stream);

10
mingw-glib2.spec
View File

@ -5,7 +5,7 @@
Name: mingw-glib2
Version: 2.70.1
Release: 4%{?dist}
Release: 5%{?dist}
Summary: MinGW Windows GLib2 library
License: LGPLv2+
@ -65,6 +65,9 @@ Patch4: mingw-glib2-2.70.1-CVE-2026-58014.patch
# https://github.com/GNOME/glib/commit/c9da977c178f
Patch5: mingw-glib2-2.70.1-CVE-2026-58016.patch
# https://github.com/GNOME/glib/commit/31f82e22e21bae520b7228f7f57d357fb20df8a4
Patch6: mingw-glib2-2.70.1-CVE-2025-14087.patch
%description
MinGW Windows Glib2 library.
@ -115,6 +118,7 @@ Static version of the MinGW Windows GLib2 library.
%patch3 -p1
%patch4 -p1
%patch5 -p1
%patch6 -p1
%build
%mingw_meson --default-library=both \
@ -292,6 +296,10 @@ find $RPM_BUILD_ROOT -name "*.la" -delete
%changelog
* Wed Jul 22 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.70.1-5
- Fix CVE-2025-14087: integer overflow in GVariant parser
Resolves: RHEL-154707
* Wed Jul 22 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.70.1-4
- Fix CVE-2026-58016: D-Bus introspection XML node nesting check
Resolves: RHEL-190617