From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Matthias Clasen To: git-commits@fedoraproject.org Subject: [rpms/glib2] cve-2026-58016-f44: fix desktop file handling Date: Tue, 11 Aug 2026 10:33:35 GMT Message-ID: <178644441593.1.3459015693791116799.rpms-glib2-f83bdb3324f1@fedoraproject.org> List-ID: X-Git-Repo: rpms/glib2 X-Git-Branch: cve-2026-58016-f44 X-Git-Rev: f83bdb3324f16ee3222bfd4a2180604a992e169d QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvZ2xpYjIKQnJhbmNo IDogY3ZlLTIwMjYtNTgwMTYtZjQ0CkNvbW1pdCA6IGY4M2JkYjMzMjRmMTZlZTMyMjJiZmQ0YTIx ODA2MDRhOTkyZTE2OWQKQXV0aG9yIDogTWF0dGhpYXMgQ2xhc2VuIDxtY2xhc2VuQGZlZG9yYXBy b2plY3Qub3JnPgpEYXRlICAgOiAyMDA3LTEyLTIyVDE4OjA2OjAyKzAwOjAwClN0YXRzICA6ICsx MTUvLTEgaW4gMiBmaWxlKHMpClVSTCAgICA6IGh0dHBzOi8vc3JjLmZlZG9yYXByb2plY3Qub3Jn L3JwbXMvZ2xpYjIvYy9mODNiZGIzMzI0ZjE2ZWUzMjIyYmZkNGEyMTgwNjA0YTk5MmUxNjlkP2Jy YW5jaD1jdmUtMjAyNi01ODAxNi1mNDQKCkxvZzoKZml4IGRlc2t0b3AgZmlsZSBoYW5kbGluZwoK LS0tCmRpZmYgLS1naXQgYS9kZXNrdG9wZmlsZXMucGF0Y2ggYi9kZXNrdG9wZmlsZXMucGF0Y2gK bmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uMzlkZTQ0YgotLS0gL2Rldi9udWxs CisrKyBiL2Rlc2t0b3BmaWxlcy5wYXRjaApAQCAtMCwwICsxLDEwNiBAQAorZGlmZiAtdXAgZ2xp Yi0yLjE1LjAvZ2lvL2dkZXNrdG9wYXBwaW5mby5jLmRlc2t0b3BmaWxlcyBnbGliLTIuMTUuMC9n aW8vZ2Rlc2t0b3BhcHBpbmZvLmMKKy0tLSBnbGliLTIuMTUuMC9naW8vZ2Rlc2t0b3BhcHBpbmZv LmMuZGVza3RvcGZpbGVzCTIwMDctMTItMjIgMTI6NDM6MDUuMDAwMDAwMDAwIC0wNTAwCisrKysg Z2xpYi0yLjE1LjAvZ2lvL2dkZXNrdG9wYXBwaW5mby5jCTIwMDctMTItMjIgMTI6NDM6MTcuMDAw MDAwMDAwIC0wNTAwCitAQCAtOTIwLDEwICs5MjAsMTAgQEAgc3RhdGljIGdib29sZWFuCisgZ19k ZXNrdG9wX2FwcF9pbmZvX3N1cHBvcnRzX3VyaXMgKEdBcHBJbmZvICphcHBpbmZvKQorIHsKKyAg IEdEZXNrdG9wQXBwSW5mbyAqaW5mbyA9IEdfREVTS1RPUF9BUFBfSU5GTyAoYXBwaW5mbyk7Cist ICAKKy0gIHJldHVybgorLSAgICAoc3Ryc3RyIChpbmZvLT5leGVjLCAiJXUiKSAhPSBOVUxMKSB8 fAorLSAgICAoc3Ryc3RyIChpbmZvLT5leGVjLCAiJVUiKSAhPSBOVUxMKTsKKysgCisrICByZXR1 cm4gaW5mby0+ZXhlYyAmJiAKKysgICAgKChzdHJzdHIgKGluZm8tPmV4ZWMsICIldSIpICE9IE5V TEwpIHx8CisrICAgICAoc3Ryc3RyIChpbmZvLT5leGVjLCAiJVUiKSAhPSBOVUxMKSk7CisgfQor IAorIHN0YXRpYyBnYm9vbGVhbgorQEAgLTE1ODEsNyArMTU4MSw4IEBAIGdfYXBwX2luZm9fZ2V0 X2RlZmF1bHRfZm9yX3R5cGUgKGNvbnN0IGMKKyAgKiBnX2FwcF9pbmZvX2dldF9kZWZhdWx0X2Zv cl91cmlfc2NoZW1lOgorICAqIEB1cmlfc2NoZW1lOiBhIHN0cmluZyBjb250YWluaW5nIGEgVVJJ IHNjaGVtZS4KKyAgKgorLSAqIEdldHMgdGhlIGRlZmF1bHQgYXBwbGljYXRpb24gZm9yIGxhdW5j aGluZyBhcHBsaWNhdGlvbnMgdXNpbmcgdGhpcyBVUkkgc2NoZW1lLgorKyAqIEdldHMgdGhlIGRl ZmF1bHQgYXBwbGljYXRpb24gZm9yIGxhdW5jaGluZyBhcHBsaWNhdGlvbnMgCisrICogdXNpbmcg dGhpcyBVUkkgc2NoZW1lLgorICAqCisgICogVE9ETzogVGhpcyBpcyBjdXJyZW50bHkgdW5pbXBs ZW1lbnRlZC4KKyAgKiAKK0BAIC0xNjI1LDExICsxNjI2LDEyIEBAIGdldF9hcHBzX2Zyb21fZGly IChHSGFzaFRhYmxlICphcHBzLCAKKyAKKyAJCSAgLyogRG9uJ3QgcmV0dXJuIGFwcHMgdGhhdCBk b24ndCB0YWtlIGFyZ3VtZW50cyAqLworIAkJICBpZiAoYXBwaW5mbyAmJgorLQkJICAgICAgZ19k ZXNrdG9wX2FwcF9pbmZvX2dldF9pc19oaWRkZW4gKGFwcGluZm8pICYmCistCQkgICAgICBzdHJz dHIgKGFwcGluZm8tPmV4ZWMsIiVVIikgPT0gTlVMTCAmJgorLQkJICAgICAgc3Ryc3RyIChhcHBp bmZvLT5leGVjLCIldSIpID09IE5VTEwgJiYKKy0JCSAgICAgIHN0cnN0ciAoYXBwaW5mby0+ZXhl YywiJWYiKSA9PSBOVUxMICYmCistCQkgICAgICBzdHJzdHIgKGFwcGluZm8tPmV4ZWMsIiVGIikg PT0gTlVMTCkKKysJCSAgICAgIChnX2Rlc2t0b3BfYXBwX2luZm9fZ2V0X2lzX2hpZGRlbiAoYXBw aW5mbykgfHwKKysJCSAgICAgICAoYXBwaW5mby0+ZXhlYyAmJiAKKysJCQlzdHJzdHIgKGFwcGlu Zm8tPmV4ZWMsIiVVIikgPT0gTlVMTCAmJgorKwkJCXN0cnN0ciAoYXBwaW5mby0+ZXhlYywiJXUi KSA9PSBOVUxMICYmCisrCQkJc3Ryc3RyIChhcHBpbmZvLT5leGVjLCIlZiIpID09IE5VTEwgJiYK KysJCQlzdHJzdHIgKGFwcGluZm8tPmV4ZWMsIiVGIikgPT0gTlVMTCkpKQorIAkJICAgIHsKKyAJ CSAgICAgIGdfb2JqZWN0X3VucmVmIChhcHBpbmZvKTsKKyAJCSAgICAgIGFwcGluZm8gPSBOVUxM OworQEAgLTE2NzksNyArMTY4MSw3IEBAIGdfYXBwX2luZm9fZ2V0X2FsbCAodm9pZCkKKyAgIGNv bnN0IGNoYXIgKiBjb25zdCAqZGlyczsKKyAgIEdIYXNoVGFibGUgKmFwcHM7CisgICBHSGFzaFRh YmxlSXRlciBpdGVyOworLSAgZ3BvaW50ZXIga2V5OworKyAgZ3BvaW50ZXIgdmFsdWU7CisgICBp bnQgaTsKKyAgIEdMaXN0ICppbmZvczsKKyAKK0BAIC0xNjk1LDggKzE2OTcsOCBAQCBnX2FwcF9p bmZvX2dldF9hbGwgKHZvaWQpCisgCisgICBpbmZvcyA9IE5VTEw7CisgICBnX2hhc2hfdGFibGVf aXRlcl9pbml0ICgmaXRlciwgYXBwcyk7CistICB3aGlsZSAoZ19oYXNoX3RhYmxlX2l0ZXJfbmV4 dCAoJml0ZXIsICZrZXksIE5VTEwpKQorLSAgICBpbmZvcyA9IGdfbGlzdF9wcmVwZW5kIChpbmZv cywga2V5KTsKKysgIHdoaWxlIChnX2hhc2hfdGFibGVfaXRlcl9uZXh0ICgmaXRlciwgTlVMTCwg JnZhbHVlKSkKKysgICAgaW5mb3MgPSBnX2xpc3RfcHJlcGVuZCAoaW5mb3MsIHZhbHVlKTsKKyAK KyAgIGdfaGFzaF90YWJsZV9kZXN0cm95IChhcHBzKTsKKyAKK0BAIC0yMTQyLDEzICsyMTQ0LDEz IEBAIGFwcGVuZF9kZXNrdG9wX2VudHJ5IChHTGlzdCAgICAgICpsaXN0LCAKKyAgKiBnZXRfYWxs X2Rlc2t0b3BfZW50cmllc19mb3JfbWltZV90eXBlOgorICAqIEBtaW1lX3R5cGU6IGEgbWltZSB0 eXBlLgorICAqCistICogUmV0dXJucyBhbGwgdGhlIGRlc2t0b3AgZmlsZW5hbWVzIGZvciBAbWlt ZV90eXBlLiBUaGUgZGVza3RvcCBmaWxlcworKyAqIFJldHVybnMgYWxsIHRoZSBkZXNrdG9wIGlk cyBmb3IgQG1pbWVfdHlwZS4gVGhlIGRlc2t0b3AgZmlsZXMKKyAgKiBhcmUgbGlzdGVkIGluIGFu IG9yZGVyIHNvIHRoYXQgZGVmYXVsdCBhcHBsaWNhdGlvbnMgYXJlIGxpc3RlZCBiZWZvcmUKKyAg KiBub24tZGVmYXVsdCBvbmVzLCBhbmQgaGFuZGxlcnMgZm9yIGluaGVyaXRlZCBtaW1ldHlwZXMg YXJlIGxpc3RlZAorICAqIGFmdGVyIHRoZSBiYXNlIG9uZXMuCisgICoKKy0gKiBSZXR1cm4gdmFs dWU6IGEgI0dMaXN0IGNvbnRhaW5pbmcgdGhlIGRlc2t0b3AgZmlsZW5hbWVzIGNvbnRhaW5pbmcg dGhlCistICogQG1pbWVfdHlwZS4KKysgKiBSZXR1cm4gdmFsdWU6IGEgI0dMaXN0IGNvbnRhaW5p bmcgdGhlIGRlc2t0b3AgaWRzIHdoaWNoIGNsYWltCisrICogICAgdG8gaGFuZGxlIEBtaW1lX3R5 cGUuCisgICovCisgc3RhdGljIEdMaXN0ICoKKyBnZXRfYWxsX2Rlc2t0b3BfZW50cmllc19mb3Jf bWltZV90eXBlIChjb25zdCBjaGFyICpiYXNlX21pbWVfdHlwZSkKK2RpZmYgLXVwIGdsaWItMi4x NS4wL2dpby9nYXBwaW5mby5jLmRlc2t0b3BmaWxlcyBnbGliLTIuMTUuMC9naW8vZ2FwcGluZm8u YworLS0tIGdsaWItMi4xNS4wL2dpby9nYXBwaW5mby5jLmRlc2t0b3BmaWxlcwkyMDA3LTEyLTIy IDEyOjQyOjU3LjAwMDAwMDAwMCAtMDUwMAorKysrIGdsaWItMi4xNS4wL2dpby9nYXBwaW5mby5j CTIwMDctMTItMjIgMTI6NDM6MTcuMDAwMDAwMDAwIC0wNTAwCitAQCAtMTM5LDYgKzEzOSw5IEBA IGdfYXBwX2luZm9fZXF1YWwgKEdBcHBJbmZvICphcHBpbmZvMSwKKyAgKiBwbGF0Zm9ybSBkZXBl bmRlbnQuIEZvciBpbnN0YW5jZSBvbiBVbml4IHRoaXMgaXMgdGhlCisgICogZGVza3RvcCBmaWxl IGlkIGZyb20gdGhlIHhkZyBtZW51IHNwZWNpZmljYXRpb24uCisgICoKKysgKiBOb3RlIHRoYXQg dGhlIHJldHVybmVkIElEIG1heSBiZSAlTlVMTCwgZGVwZW5kaW5nIG9uIGhvdworKyAqIHRoZSBA YXBwaW5mbyBoYXMgYmVlbiBjb25zdHJ1Y3RlZC4KKysgKgorICAqIFJldHVybnM6IGEgc3RyaW5n IGNvbnRhaW5pbmcgdGhlIGFwcGxpY2F0aW9uJ3MgSUQuCisgICoqLworIGNvbnN0IGNoYXIgKgor QEAgLTE4MCw4ICsxODMsNyBAQCBnX2FwcF9pbmZvX2dldF9uYW1lIChHQXBwSW5mbyAqYXBwaW5m bykKKyAgKiBHZXRzIGEgaHVtYW4tcmVhZGFibGUgZGVzY3JpcHRpb24gb2YgYW4gaW5zdGFsbGVk IGFwcGxpY2F0aW9uLgorICAqCisgICogUmV0dXJuczogYSBzdHJpbmcgY29udGFpbmluZyBhIGRl c2NyaXB0aW9uIG9mIHRoZSAKKy0gKiBhcHBsaWNhdGlvbiBAYXBwaW5mbywgb3IgJU5VTEwgaWYg bm9uZS4gVGhlIHJldHVybmVkIHN0cmluZyBzaG91bGQgYmUgbm90IGZyZWVkIAorLSAqIHdoZW4g bm8gbG9uZ2VyIG5lZWRlZC4KKysgKiBhcHBsaWNhdGlvbiBAYXBwaW5mbywgb3IgJU5VTEwgaWYg bm9uZS4gCisgICoqLworIGNvbnN0IGNoYXIgKgorIGdfYXBwX2luZm9fZ2V0X2Rlc2NyaXB0aW9u IChHQXBwSW5mbyAqYXBwaW5mbykKCmRpZmYgLS1naXQgYS9nbGliMi5zcGVjIGIvZ2xpYjIuc3Bl YwppbmRleCA3YzgzZWQ4Li41MzI0MzUyIDEwMDY0NAotLS0gYS9nbGliMi5zcGVjCisrKyBiL2ds aWIyLnNwZWMKQEAgLTMsMTMgKzMsMTQgQEAKIFN1bW1hcnk6IEEgbGlicmFyeSBvZiBoYW5keSB1 dGlsaXR5IGZ1bmN0aW9ucwogTmFtZTogZ2xpYjIKIFZlcnNpb246IDIuMTUuMAotUmVsZWFzZTog MiV7P2Rpc3R9CitSZWxlYXNlOiAzJXs/ZGlzdH0KIExpY2Vuc2U6IExHUEx2MisKIEdyb3VwOiBT eXN0ZW0gRW52aXJvbm1lbnQvTGlicmFyaWVzCiBVUkw6IGh0dHA6Ly93d3cuZ3RrLm9yZwogU291 cmNlOiBodHRwOi8vZG93bmxvYWQuZ25vbWUub3JnL3NvdXJjZXMvZ2xpYi8yLjE1L2dsaWItJXt2 ZXJzaW9ufS50YXIuYnoyCiBTb3VyY2UyOiBnbGliMi5zaAogU291cmNlMzogZ2xpYjIuY3NoCitQ YXRjaDA6IGRlc2t0b3BmaWxlcy5wYXRjaAogQnVpbGRSb290OiAle190bXBwYXRofS8le25hbWV9 LSV7dmVyc2lvbn0tJXtyZWxlYXNlfS1yb290LSUoJXtfX2lkX3V9IC1uKQogQnVpbGRSZXF1aXJl czogcGtnY29uZmlnID49IDE6MC4xNAogQnVpbGRSZXF1aXJlczogZ2FtaW4tZGV2ZWwKQEAgLTQ4 LDcgKzQ5LDExIEBAIG9mIHZlcnNpb24gMiBvZiB0aGUgR0xpYiBsaWJyYXJ5LgogCiAlcHJlcAog JXNldHVwIC1xIC1uIGdsaWItJXt2ZXJzaW9ufQorPDw8PDw8PCBnbGliMi5zcGVjCislcGF0Y2gw IC1wMSAtYiAuZGVza3RvcGZpbGVzCis9PT09PT09CiAlcGF0Y2gwIC1wMSAtYiAuZ3Rlc3R1dGls cy5wYXRjaAorPj4+Pj4+PiAxLjE0NgogCiAlYnVpbGQKIGZvciBpIGluIGNvbmZpZy5ndWVzcyBj b25maWcuc3ViIDsgZG8KQEAgLTEyNCw2ICsxMjksOSBAQCBybSAtcmYgJFJQTV9CVUlMRF9ST09U CiAle19saWJkaXJ9L2xpYiouYQogCiAlY2hhbmdlbG9nCisqIFNhdCBEZWMgMjIgMjAwNyBNYXR0 aGlhcyBDbGFzZW4gPG1jbGFzZW5AcmVkaGF0LmNvbT4gLSAyLjE1LjAtMworLSBGaXggc29tZSBl cnJvcnMgaW4gZGVza3RvcCBmaWxlcyBoYW5kbGluZworCiAqIEZyaSBEZWMgMjEgMjAwNyBDYW9s YW4gTWNOYW1hcmEgPGNhb2xhbm1AcmVkaGF0LmNvbT4gLSAyLjE1LjAtMgogLSBhZGQgamFrdWJz IHBhdGNoIGluIHNvIHh1bHJ1bm5lciB3aWxsIGJ1aWxkIGFuZCBzbyBnY2MgdG9vCiAK