From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: David Zeuthen To: git-commits@fedoraproject.org Subject: [rpms/glib2] cve-2026-58016-f44: - Only pass URI's for gio apps (#442835) Date: Tue, 11 Aug 2026 10:33:44 GMT Message-ID: <178644442486.1.11065541700129363505.rpms-glib2-58ed49b93fac@fedoraproject.org> List-ID: X-Git-Repo: rpms/glib2 X-Git-Branch: cve-2026-58016-f44 X-Git-Rev: 58ed49b93fac27af091cfedfb98aa8e55702e365 QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvZ2xpYjIKQnJhbmNo IDogY3ZlLTIwMjYtNTgwMTYtZjQ0CkNvbW1pdCA6IDU4ZWQ0OWI5M2ZhYzI3YWYwOTFjZmVkZmI5 OGFhOGU1NTcwMmUzNjUKQXV0aG9yIDogRGF2aWQgWmV1dGhlbiA8ZGF2aWR6QGZlZG9yYXByb2pl Y3Qub3JnPgpEYXRlICAgOiAyMDA4LTA0LTE3VDIzOjQ5OjEzKzAwOjAwClN0YXRzICA6ICsxMTgv LTEgaW4gMiBmaWxlKHMpClVSTCAgICA6IGh0dHBzOi8vc3JjLmZlZG9yYXByb2plY3Qub3JnL3Jw bXMvZ2xpYjIvYy81OGVkNDliOTNmYWMyN2FmMDkxY2ZlZGZiOThhYThlNTU3MDJlMzY1P2JyYW5j aD1jdmUtMjAyNi01ODAxNi1mNDQKCkxvZzoKLSBPbmx5IHBhc3MgVVJJJ3MgZm9yIGdpbyBhcHBz ICgjNDQyODM1KQoKLS0tCmRpZmYgLS1naXQgYS9naW8tMi4xNi1vbmx5LXBhc3MtdXJpLXRvLWdp by1hcHBzLnBhdGNoIGIvZ2lvLTIuMTYtb25seS1wYXNzLXVyaS10by1naW8tYXBwcy5wYXRjaApu ZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi5mNjQ2NzEwCi0tLSAvZGV2L251bGwK KysrIGIvZ2lvLTIuMTYtb25seS1wYXNzLXVyaS10by1naW8tYXBwcy5wYXRjaApAQCAtMCwwICsx LDExMCBAQAorSW5kZXg6IGdpby9nZGVza3RvcGFwcGluZm8uYworPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQorLS0tIGdp by9nZGVza3RvcGFwcGluZm8uYwkocmV2aXNpb24gNjg1MSkKKysrKyBnaW8vZ2Rlc2t0b3BhcHBp bmZvLmMJKHdvcmtpbmcgY29weSkKK0BAIC0xLDMgKzEsNSBAQAorKy8qIC0qLSBtb2RlOiBDOyBj LWZpbGUtc3R5bGU6ICJnbnUiOyBpbmRlbnQtdGFicy1tb2RlOiBuaWw7IC0qLSAqLworKworIC8q IEdJTyAtIEdMaWIgSW5wdXQsIE91dHB1dCBhbmQgU3RyZWFtaW5nIExpYnJhcnkKKyAgKiAKKyAg KiBDb3B5cmlnaHQgKEMpIDIwMDYtMjAwNyBSZWQgSGF0LCBJbmMuCitAQCAtODcsNiArODksNyBA QAorICAgY2hhciAqZXhlYzsKKyAgIGNoYXIgKmJpbmFyeTsKKyAgIGNoYXIgKnBhdGg7CisrICBj aGFyICp2ZnNfc3lzdGVtOworIAorICAgZ3VpbnQgbm9kaXNwbGF5ICAgICAgIDogMTsKKyAgIGd1 aW50IGhpZGRlbiAgICAgICAgICA6IDE7CitAQCAtMTQ5LDYgKzE1Miw3IEBACisgICBnX2ZyZWUg KGluZm8tPnRyeV9leGVjKTsKKyAgIGdfZnJlZSAoaW5mby0+ZXhlYyk7CisgICBnX2ZyZWUgKGlu Zm8tPmJpbmFyeSk7CisrICBnX2ZyZWUgKGluZm8tPnZmc19zeXN0ZW0pOworICAgZ19mcmVlIChp bmZvLT5wYXRoKTsKKyAgIAorICAgR19PQkpFQ1RfQ0xBU1MgKGdfZGVza3RvcF9hcHBfaW5mb19w YXJlbnRfY2xhc3MpLT5maW5hbGl6ZSAob2JqZWN0KTsKK0BAIC0yNjQsNiArMjY4LDcgQEAKKyAg IGluZm8tPnRlcm1pbmFsID0gZ19rZXlfZmlsZV9nZXRfYm9vbGVhbiAoa2V5X2ZpbGUsIEdfS0VZ X0ZJTEVfREVTS1RPUF9HUk9VUCwgR19LRVlfRklMRV9ERVNLVE9QX0tFWV9URVJNSU5BTCwgTlVM TCkgIT0gRkFMU0U7CisgICBpbmZvLT5zdGFydHVwX25vdGlmeSA9IGdfa2V5X2ZpbGVfZ2V0X2Jv b2xlYW4gKGtleV9maWxlLCBHX0tFWV9GSUxFX0RFU0tUT1BfR1JPVVAsIEdfS0VZX0ZJTEVfREVT S1RPUF9LRVlfU1RBUlRVUF9OT1RJRlksIE5VTEwpICE9IEZBTFNFOworICAgaW5mby0+aGlkZGVu ID0gZ19rZXlfZmlsZV9nZXRfYm9vbGVhbiAoa2V5X2ZpbGUsIEdfS0VZX0ZJTEVfREVTS1RPUF9H Uk9VUCwgR19LRVlfRklMRV9ERVNLVE9QX0tFWV9ISURERU4sIE5VTEwpICE9IEZBTFNFOworKyAg aW5mby0+dmZzX3N5c3RlbSA9IGdfa2V5X2ZpbGVfZ2V0X3N0cmluZyAoa2V5X2ZpbGUsIEdfS0VZ X0ZJTEVfREVTS1RPUF9HUk9VUCwgIlgtR25vbWUtVmZzLVN5c3RlbSIsIE5VTEwpOworIAorICAg Z19rZXlfZmlsZV9mcmVlIChrZXlfZmlsZSk7CisgICAKK0BAIC00OTgsOSArNTAzLDM1IEBACisg eworICAgR0xpc3QgKnVyaXMgPSAqdXJpX2xpc3Q7CisgICBjaGFyICpleHBhbmRlZDsKKy0gIAor KyAgZ2Jvb2xlYW4gZm9yY2VfZmlsZV91cmk7CisrICBjaGFyIGZvcmNlX2ZpbGVfdXJpX21hY3Jv OworKworICAgZ19yZXR1cm5faWZfZmFpbCAoZXhlYyAhPSBOVUxMKTsKKy0gIAorKworKyAgLyog T24gJXUgYW5kICVVLCBvbmx5IHBhc3MgZ2lvIFVSSSdzIGlmIHRoZSBkZXNrdG9wIGZpbGUgaGFz IHRoZQorKyAgICogWC1Hbm9tZS1WZnMtU3lzdGVtIGtleSBzZXQgdG8gJ2dpbycgb3IgaWYgRlVT RSBpcyBub3QgYXZhaWxhYmxlLgorKyAgICogT3RoZXJ3aXNlIHdlIHBhc3MgaW4gYSBQT1NJWCBm aWxlIHBhdGggcG9pbnRpbmcgdG8gdGhlIFVSSSB2aWEKKysgICAqIHRoZSBGVVNFIG1vdW50IGlu IH4vLmd2ZnMuCisrICAgKi8KKysgIGZvcmNlX2ZpbGVfdXJpID0gRkFMU0U7CisrICBpZiAobWFj cm8gPT0gJ3UnIHx8IG1hY3JvID09ICdVJykKKysgICAgeworKyAgICAgIGlmIChpbmZvLT52ZnNf c3lzdGVtID09IE5VTEwgfHwgc3RyY21wIChpbmZvLT52ZnNfc3lzdGVtLCAiZ2lvIikgIT0gMCkK KysgICAgICAgIHsKKysgICAgICAgICAgc3dpdGNoIChtYWNybykKKysgICAgICAgICAgICB7Cisr ICAgICAgICAgICAgY2FzZSAndSc6CisrICAgICAgICAgICAgICBmb3JjZV9maWxlX3VyaV9tYWNy byA9ICdmJzsKKysgICAgICAgICAgICAgIGZvcmNlX2ZpbGVfdXJpID0gVFJVRTsKKysgICAgICAg ICAgICAgIGJyZWFrOworKyAgICAgICAgICAgIGNhc2UgJ1UnOgorKyAgICAgICAgICAgICAgZm9y Y2VfZmlsZV91cmlfbWFjcm8gPSAnRic7CisrICAgICAgICAgICAgICBmb3JjZV9maWxlX3VyaSA9 IFRSVUU7CisrICAgICAgICAgICAgICBicmVhazsKKysgICAgICAgICAgICB9CisrICAgICAgICB9 CisrICAgIH0KKysKKyAgIHN3aXRjaCAobWFjcm8pCisgICAgIHsKKyAgICAgY2FzZSAndSc6CitA QCAtNTA5LDcgKzU0MCwxNyBAQAorICAgICBjYXNlICduJzoKKyAgICAgICBpZiAodXJpcykKKyAJ eworLQkgIGV4cGFuZGVkID0gZXhwYW5kX21hY3JvX3NpbmdsZSAobWFjcm8sIHVyaXMtPmRhdGEp OworKyAgICAgICAgICBpZiAoIWZvcmNlX2ZpbGVfdXJpIHx8IGdfc3RyX2hhc19wcmVmaXggKHVy aXMtPmRhdGEsICJodHRwIikpCisrICAgICAgICAgICAgeworKyAgICAgICAgICAgICAgZXhwYW5k ZWQgPSBleHBhbmRfbWFjcm9fc2luZ2xlIChtYWNybywgdXJpcy0+ZGF0YSk7CisrICAgICAgICAg ICAgfQorKyAgICAgICAgICBlbHNlCisrICAgICAgICAgICAgeworKyAgICAgICAgICAgICAgZXhw YW5kZWQgPSBleHBhbmRfbWFjcm9fc2luZ2xlIChmb3JjZV9maWxlX3VyaV9tYWNybywgdXJpcy0+ ZGF0YSk7CisrICAgICAgICAgICAgICBpZiAoZXhwYW5kZWQgPT0gTlVMTCkKKysgICAgICAgICAg ICAgICAgZXhwYW5kZWQgPSBleHBhbmRfbWFjcm9fc2luZ2xlIChtYWNybywgdXJpcy0+ZGF0YSk7 CisrICAgICAgICAgICAgfQorKworIAkgIGlmIChleHBhbmRlZCkKKyAJICAgIHsKKyAJICAgICAg Z19zdHJpbmdfYXBwZW5kIChleGVjLCBleHBhbmRlZCk7CitAQCAtNTI2LDcgKzU2NywxNyBAQAor ICAgICBjYXNlICdOJzoKKyAgICAgICB3aGlsZSAodXJpcykKKyAJeworLQkgIGV4cGFuZGVkID0g ZXhwYW5kX21hY3JvX3NpbmdsZSAobWFjcm8sIHVyaXMtPmRhdGEpOworKyAgICAgICAgICBpZiAo IWZvcmNlX2ZpbGVfdXJpIHx8IGdfc3RyX2hhc19wcmVmaXggKHVyaXMtPmRhdGEsICJodHRwIikp CisrICAgICAgICAgICAgeworKyAgICAgICAgICAgICAgZXhwYW5kZWQgPSBleHBhbmRfbWFjcm9f c2luZ2xlIChtYWNybywgdXJpcy0+ZGF0YSk7CisrICAgICAgICAgICAgfQorKyAgICAgICAgICBl bHNlCisrICAgICAgICAgICAgeworKyAgICAgICAgICAgICAgZXhwYW5kZWQgPSBleHBhbmRfbWFj cm9fc2luZ2xlIChmb3JjZV9maWxlX3VyaV9tYWNybywgdXJpcy0+ZGF0YSk7CisrICAgICAgICAg ICAgICBpZiAoZXhwYW5kZWQgPT0gTlVMTCkKKysgICAgICAgICAgICAgICAgZXhwYW5kZWQgPSBl eHBhbmRfbWFjcm9fc2luZ2xlIChtYWNybywgdXJpcy0+ZGF0YSk7CisrICAgICAgICAgICAgfQor KworIAkgIGlmIChleHBhbmRlZCkKKyAJICAgIHsKKyAJICAgICAgZ19zdHJpbmdfYXBwZW5kIChl eGVjLCBleHBhbmRlZCk7CgpkaWZmIC0tZ2l0IGEvZ2xpYjIuc3BlYyBiL2dsaWIyLnNwZWMKaW5k ZXggZjU0YjY5My4uOTFkZTJkMyAxMDA2NDQKLS0tIGEvZ2xpYjIuc3BlYworKysgYi9nbGliMi5z cGVjCkBAIC0zLDcgKzMsNyBAQAogU3VtbWFyeTogQSBsaWJyYXJ5IG9mIGhhbmR5IHV0aWxpdHkg ZnVuY3Rpb25zCiBOYW1lOiBnbGliMgogVmVyc2lvbjogMi4xNi4zCi1SZWxlYXNlOiAzJXs/ZGlz dH0KK1JlbGVhc2U6IDQlez9kaXN0fQogTGljZW5zZTogTEdQTHYyKwogR3JvdXA6IFN5c3RlbSBF bnZpcm9ubWVudC9MaWJyYXJpZXMKIFVSTDogaHR0cDovL3d3dy5ndGsub3JnCkBAIC0yNiw2ICsy Niw5IEBAIFBhdGNoMDogYXBwaW5mby5wYXRjaAogIyBjb21taXR0ZWQgb24gTWFyY2ggMTIsIDIw MDgKIFBhdGNoMTogcmV2ZXJ0LTMxNjIyMS5wYXRjaAogCisjIGh0dHBzOi8vYnVnemlsbGEucmVk aGF0LmNvbS9zaG93X2J1Zy5jZ2k/aWQ9NDQyODM1CitQYXRjaDI6IGdpby0yLjE2LW9ubHktcGFz cy11cmktdG8tZ2lvLWFwcHMucGF0Y2gKKwogJWRlc2NyaXB0aW9uIAogR0xpYiBpcyB0aGUgbG93 LWxldmVsIGNvcmUgbGlicmFyeSB0aGF0IGZvcm1zIHRoZSBiYXNpcwogZm9yIHByb2plY3RzIHN1 Y2ggYXMgR1RLKyBhbmQgR05PTUUuIEl0IHByb3ZpZGVzIGRhdGEgc3RydWN0dXJlCkBAIC01OSw2 ICs2Miw3IEBAIG9mIHZlcnNpb24gMiBvZiB0aGUgR0xpYiBsaWJyYXJ5LgogJXNldHVwIC1xIC1u IGdsaWItJXt2ZXJzaW9ufQogJXBhdGNoMCAtcDEgLWIgLmFwcGluZm8KICVwYXRjaDEgLVIgLXAx IC1iIC5yZXZlcnQtMzE2MjIxCislcGF0Y2gyIC1wMCAtYiAub25seS1wYXNzLXVyaS10by1naW8t YXBwcwogCiAlYnVpbGQKICVjb25maWd1cmUgLS1kaXNhYmxlLWd0ay1kb2MgLS1lbmFibGUtc3Rh dGljIApAQCAtMTMxLDYgKzEzNSw5IEBAIHJtIC1yZiAkUlBNX0JVSUxEX1JPT1QKICV7X2xpYmRp cn0vbGliKi5hCiAKICVjaGFuZ2Vsb2cKKyogVGh1IEFwciAxNyAyMDA4IERhdmlkIFpldXRoZW4g PGRhdmlkekByZWRoYXQuY29tPiAtIDIuMTYuMy00CistIE9ubHkgcGFzcyBVUkkncyBmb3IgZ2lv IGFwcHMgKCM0NDI4MzUpCisKICogU3VuIEFwciAxMyAyMDA4IERhbiBXaWxsaWFtcyA8ZGNid0By ZWRoYXQuY29tPiAtIDIuMTYuMy0zCiAtIFJldmVydCB1cHN0cmVhbSBjaGFuZ2VzIHRvIGdfc3Rh dGljX211dGV4X2dldF9tdXRleF9pbXBsX3Nob3J0Y3V0IHRoYXQgYnJva2UKICAgICB1c2VycyBv ZiBHTXV0ZXggYW5kIEdTdGF0aWNNdXRleCAoYmdvIzMxNjIyMSkK