From d9b676102825ccdb2ebc96030a73e9ccdd18a645 Mon Sep 17 00:00:00 2001
From: RHEL Packaging Agent <redhat-ymir-agent@redhat.com>
Date: Wed, 22 Jul 2026 15:57:58 +0000
Subject: [PATCH] Fix CVE-2025-14087: integer overflow in GVariant parser

Backport upstream commit 31f82e22 to fix CVE-2025-14087 in
mingw-glib2. The patch changes loop counter types from `int` to
`size_t` in glib/gvariant-parser.c to prevent potential integer
overflow when parsing string and bytestring literals longer than
INT_MAX in GVariant text format input.

CVE: CVE-2025-14087
Upstream patches:
 - https://github.com/GNOME/glib/commit/31f82e22e21bae520b7228f7f57d357fb20df8a4.patch
Resolves: RHEL-154707

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
---
 mingw-glib2-2.70.1-CVE-2025-14087.patch | 65 +++++++++++++++++++++++++
 mingw-glib2.spec                        | 10 +++-
 2 files changed, 74 insertions(+), 1 deletion(-)
 create mode 100644 mingw-glib2-2.70.1-CVE-2025-14087.patch

diff --git a/mingw-glib2-2.70.1-CVE-2025-14087.patch b/mingw-glib2-2.70.1-CVE-2025-14087.patch
new file mode 100644
index 0000000..c6c130e
--- /dev/null
+++ b/mingw-glib2-2.70.1-CVE-2025-14087.patch
@@ -0,0 +1,65 @@
+From 074d82962028125c7886e5edcff1a58a508e0e61 Mon Sep 17 00:00:00 2001
+From: Philip Withnall <pwithnall@gnome.org>
+Date: Tue, 25 Nov 2025 19:02:56 +0000
+Subject: [PATCH] gvariant-parser: Fix potential integer overflow parsing
+ (byte)strings
+
+The termination condition for parsing string and bytestring literals in
+GVariant text format input was subject to an integer overflow for input
+string (or bytestring) literals longer than `INT_MAX`.
+
+Fix that by counting as a `size_t` rather than as an `int`. The counter
+can never correctly be negative.
+
+Spotted by treeplus. Thanks to the Sovereign Tech Resilience programme
+from the Sovereign Tech Agency. ID: #YWH-PGM9867-145
+
+Signed-off-by: Philip Withnall <pwithnall@gnome.org>
+Fixes: #3834
+---
+ glib/gvariant-parser.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/glib/gvariant-parser.c b/glib/gvariant-parser.c
+index bb5238bea..af6527d40 100644
+--- a/glib/gvariant-parser.c
++++ b/glib/gvariant-parser.c
+@@ -594,7 +594,7 @@ ast_resolve (AST     *ast,
+ {
+   GVariant *value;
+   gchar *pattern;
+-  gint i, j = 0;
++  size_t i, j = 0;
+ 
+   pattern = ast_get_pattern (ast, error);
+ 
+@@ -1555,9 +1555,9 @@ string_free (AST *ast)
+  * No leading/trailing space allowed. */
+ static gboolean
+ unicode_unescape (const gchar  *src,
+-                  gint         *src_ofs,
++                  size_t       *src_ofs,
+                   gchar        *dest,
+-                  gint         *dest_ofs,
++                  size_t       *dest_ofs,
+                   gsize         length,
+                   SourceRef    *ref,
+                   GError      **error)
+@@ -1618,7 +1618,7 @@ string_parse (TokenStream  *stream,
+   gsize length;
+   gchar quote;
+   gchar *str;
+-  gint i, j;
++  size_t i, j;
+ 
+   token_stream_start_ref (stream, &ref);
+   token = token_stream_get (stream);
+@@ -1748,7 +1748,7 @@ bytestring_parse (TokenStream  *stream,
+   gsize length;
+   gchar quote;
+   gchar *str;
+-  gint i, j;
++  size_t i, j;
+ 
+   token_stream_start_ref (stream, &ref);
+   token = token_stream_get (stream);
diff --git a/mingw-glib2.spec b/mingw-glib2.spec
index a726bd6..34fb2c3 100644
--- a/mingw-glib2.spec
+++ b/mingw-glib2.spec
@@ -5,7 +5,7 @@
 
 Name:           mingw-glib2
 Version:        2.70.1
-Release:        4%{?dist}
+Release:        5%{?dist}
 Summary:        MinGW Windows GLib2 library
 
 License:        LGPLv2+
@@ -65,6 +65,9 @@ Patch4:         mingw-glib2-2.70.1-CVE-2026-58014.patch
 # https://github.com/GNOME/glib/commit/c9da977c178f
 Patch5:         mingw-glib2-2.70.1-CVE-2026-58016.patch
 
+# https://github.com/GNOME/glib/commit/31f82e22e21bae520b7228f7f57d357fb20df8a4
+Patch6:         mingw-glib2-2.70.1-CVE-2025-14087.patch
+
 %description
 MinGW Windows Glib2 library.
 
@@ -115,6 +118,7 @@ Static version of the MinGW Windows GLib2 library.
 %patch3 -p1
 %patch4 -p1
 %patch5 -p1
+%patch6 -p1
 
 %build
 %mingw_meson --default-library=both \
@@ -292,6 +296,10 @@ find $RPM_BUILD_ROOT -name "*.la" -delete
 
 
 %changelog
+* Wed Jul 22 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.70.1-5
+- Fix CVE-2025-14087: integer overflow in GVariant parser
+  Resolves: RHEL-154707
+
 * Wed Jul 22 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.70.1-4
 - Fix CVE-2026-58016: D-Bus introspection XML node nesting check
   Resolves: RHEL-190617