From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Matthias Clasen To: git-commits@fedoraproject.org Subject: [rpms/glib2] cve-2026-58016-f44: Avoid integer overflows in the base64 handing functions Date: Tue, 11 Aug 2026 10:34:02 GMT Message-ID: <178644444228.1.3330721282267554231.rpms-glib2-e06d22f3d27a@fedoraproject.org> List-ID: X-Git-Repo: rpms/glib2 X-Git-Branch: cve-2026-58016-f44 X-Git-Rev: e06d22f3d27ab1ca8d0f75e21628ddc069c57924 QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvZ2xpYjIKQnJhbmNo IDogY3ZlLTIwMjYtNTgwMTYtZjQ0CkNvbW1pdCA6IGUwNmQyMmYzZDI3YWIxY2E4ZDBmNzVlMjE2 MjhkZGMwNjljNTc5MjQKQXV0aG9yIDogTWF0dGhpYXMgQ2xhc2VuIDxtY2xhc2VuQGZlZG9yYXBy b2plY3Qub3JnPgpEYXRlICAgOiAyMDA5LTAzLTEyVDEzOjQxOjM3KzAwOjAwClN0YXRzICA6ICs3 Ni8tOCBpbiAyIGZpbGUocykKVVJMICAgIDogaHR0cHM6Ly9zcmMuZmVkb3JhcHJvamVjdC5vcmcv cnBtcy9nbGliMi9jL2UwNmQyMmYzZDI3YWIxY2E4ZDBmNzVlMjE2MjhkZGMwNjljNTc5MjQ/YnJh bmNoPWN2ZS0yMDI2LTU4MDE2LWY0NAoKTG9nOgpBdm9pZCBpbnRlZ2VyIG92ZXJmbG93cyBpbiB0 aGUgYmFzZTY0IGhhbmRpbmcgZnVuY3Rpb25zCgotLS0KZGlmZiAtLWdpdCBhL2dsaWIyLUNWRS0y MDA4LTQzMTYucGF0Y2ggYi9nbGliMi1DVkUtMjAwOC00MzE2LnBhdGNoCm5ldyBmaWxlIG1vZGUg MTAwNjQ0CmluZGV4IDAwMDAwMDAuLjc1OGEwMWIKLS0tIC9kZXYvbnVsbAorKysgYi9nbGliMi1D VkUtMjAwOC00MzE2LnBhdGNoCkBAIC0wLDAgKzEsNjIgQEAKKy0tLSBnbGliL2diYXNlNjQuYy5v cmlnCTIwMDgtMTItMDQgMTI6MDc6MjEuMDAwMDAwMDAwICswMTAwCisrKysgZ2xpYi9nYmFzZTY0 LmMJMjAwOS0wMS0xMiAxNDowODozMS4wMDAwMDAwMDAgKzAxMDAKK0BAIC01NCw4ICs1NCw5IEBA IHN0YXRpYyBjb25zdCBjaGFyIGJhc2U2NF9hbHBoYWJldFtdID0KKyAgKgorICAqIFRoZSBvdXRw dXQgYnVmZmVyIG11c3QgYmUgbGFyZ2UgZW5vdWdoIHRvIGZpdCBhbGwgdGhlIGRhdGEgdGhhdCB3 aWxsCisgICogYmUgd3JpdHRlbiB0byBpdC4gRHVlIHRvIHRoZSB3YXkgYmFzZTY0IGVuY29kZXMg eW91IHdpbGwgbmVlZAorLSAqIGF0IGxlYXN0OiBAbGVuICogNCAvIDMgKyA2IGJ5dGVzLiBJZiB5 b3UgZW5hYmxlIGxpbmUtYnJlYWtpbmcgeW91IHdpbGwKKy0gKiBuZWVkIGF0IGxlYXN0OiBAbGVu ICogNCAvIDMgKyBAbGVuICogNCAvICgzICogNzIpICsgNyBieXRlcy4KKysgKiBhdCBsZWFzdDog KEBsZW4gLyAzICsgMSkgKiA0ICsgNCBieXRlcyAoKyA0IG1heSBiZSBuZWVkZWQgaW4gY2FzZSBv ZgorKyAqIG5vbi16ZXJvIHN0YXRlKS4gSWYgeW91IGVuYWJsZSBsaW5lLWJyZWFraW5nIHlvdSB3 aWxsIG5lZWQgYXQgbGVhc3Q6CisrICogKChAbGVuIC8gMyArIDEpICogNCArIDQpIC8gNzIgKyAx IGJ5dGVzIG9mIGV4dHJhIHNwYWNlLgorICAqCisgICogQGJyZWFrX2xpbmVzIGlzIHR5cGljYWxs eSB1c2VkIHdoZW4gcHV0dGluZyBiYXNlNjQtZW5jb2RlZCBkYXRhIGluIGVtYWlscy4KKyAgKiBJ dCBicmVha3MgdGhlIGxpbmVzIGF0IDcyIGNvbHVtbnMgaW5zdGVhZCBvZiBwdXR0aW5nIGFsbCBv ZiB0aGUgdGV4dCBvbiAKK0BAIC0yMzMsOCArMjM0LDE0IEBAIGdfYmFzZTY0X2VuY29kZSAoY29u c3QgZ3VjaGFyICpkYXRhLCAKKyAgIGdfcmV0dXJuX3ZhbF9pZl9mYWlsIChkYXRhICE9IE5VTEws IE5VTEwpOworICAgZ19yZXR1cm5fdmFsX2lmX2ZhaWwgKGxlbiA+IDAsIE5VTEwpOworIAorLSAg LyogV2UgY2FuIHVzZSBhIHNtYWxsZXIgbGltaXQgaGVyZSwgc2luY2Ugd2Uga25vdyB0aGUgc2F2 ZWQgc3RhdGUgaXMgMCAqLworLSAgb3V0ID0gZ19tYWxsb2MgKGxlbiAqIDQgLyAzICsgNCk7Cisr ICAvKiBXZSBjYW4gdXNlIGEgc21hbGxlciBsaW1pdCBoZXJlLCBzaW5jZSB3ZSBrbm93IHRoZSBz YXZlZCBzdGF0ZSBpcyAwLAorKyAgICAgKzEgaXMgbmVlZGVkIGZvciB0cmFpbGluZyBcMCwgYWxz byBjaGVjayBmb3IgdW5saWtlbHkgaW50ZWdlciBvdmVyZmxvdyAqLworKyAgaWYgKGxlbiA+PSAo KEdfTUFYU0laRSAtIDEpIC8gNCAtIDEpICogMykKKysgICAgZ19lcnJvcigiJXM6IGlucHV0IHRv byBsYXJnZSBmb3IgQmFzZTY0IGVuY29kaW5nICglIkdfR1NJWkVfRk9STUFUIiBjaGFycykiLAor KyAgICAgICAgR19TVFJMT0MsIGxlbik7CisrCisrICBvdXQgPSBnX21hbGxvYyAoKGxlbiAvIDMg KyAxKSAqIDQgKyAxKTsKKysKKyAgIG91dGxlbiA9IGdfYmFzZTY0X2VuY29kZV9zdGVwIChkYXRh LCBsZW4sIEZBTFNFLCBvdXQsICZzdGF0ZSwgJnNhdmUpOworICAgb3V0bGVuICs9IGdfYmFzZTY0 X2VuY29kZV9jbG9zZSAoRkFMU0UsIG91dCArIG91dGxlbiwgJnN0YXRlLCAmc2F2ZSk7CisgICBv dXRbb3V0bGVuXSA9ICdcMCc7CitAQCAtMjc1LDcgKzI4Miw4IEBAIHN0YXRpYyBjb25zdCB1bnNp Z25lZCBjaGFyIG1pbWVfYmFzZTY0X3IKKyAgKgorICAqIFRoZSBvdXRwdXQgYnVmZmVyIG11c3Qg YmUgbGFyZ2UgZW5vdWdoIHRvIGZpdCBhbGwgdGhlIGRhdGEgdGhhdCB3aWxsCisgICogYmUgd3Jp dHRlbiB0byBpdC4gU2luY2UgYmFzZTY0IGVuY29kZXMgMyBieXRlcyBpbiA0IGNoYXJzIHlvdSBu ZWVkCistICogYXQgbGVhc3Q6IEBsZW4gKiAzIC8gNCBieXRlcy4KKysgKiBhdCBsZWFzdDogKEBs ZW4gLyA0KSAqIDMgKyAzIGJ5dGVzICgrIDMgbWF5IGJlIG5lZWRlZCBpbiBjYXNlIG9mIG5vbi16 ZXJvCisrICogc3RhdGUpLgorICAqIAorICAqIFJldHVybiB2YWx1ZTogVGhlIG51bWJlciBvZiBi eXRlcyBvZiBvdXRwdXQgdGhhdCB3YXMgd3JpdHRlbgorICAqCitAQCAtMzU4LDcgKzM2Niw4IEBA IGdfYmFzZTY0X2RlY29kZSAoY29uc3QgZ2NoYXIgKnRleHQsCisgCQkgZ3NpemUgICAgICAgKm91 dF9sZW4pCisgeworICAgZ3VjaGFyICpyZXQ7CistICBnaW50IGlucHV0X2xlbmd0aCwgc3RhdGUg PSAwOworKyAgZ3NpemUgaW5wdXRfbGVuZ3RoOworKyAgZ2ludCBzdGF0ZSA9IDA7CisgICBndWlu dCBzYXZlID0gMDsKKyAgIAorICAgZ19yZXR1cm5fdmFsX2lmX2ZhaWwgKHRleHQgIT0gTlVMTCwg TlVMTCk7CitAQCAtMzY4LDcgKzM3Nyw5IEBAIGdfYmFzZTY0X2RlY29kZSAoY29uc3QgZ2NoYXIg KnRleHQsCisgCisgICBnX3JldHVybl92YWxfaWZfZmFpbCAoaW5wdXRfbGVuZ3RoID4gMSwgTlVM TCk7CisgCistICByZXQgPSBnX21hbGxvYzAgKGlucHV0X2xlbmd0aCAqIDMgLyA0KTsKKysgIC8q IFdlIGNhbiB1c2UgYSBzbWFsbGVyIGxpbWl0IGhlcmUsIHNpbmNlIHdlIGtub3cgdGhlIHNhdmVk IHN0YXRlIGlzIDAsCisrICAgICArMSB1c2VkIHRvIGF2b2lkIGNhbGxpbmcgZ19tYWxsb2MwKDAp LCBhbmQgaGVuY2UgcmV0cnVuaW5nIE5VTEwgKi8KKysgIHJldCA9IGdfbWFsbG9jMCAoKGlucHV0 X2xlbmd0aCAvIDQpICogMyArIDEpOworICAgCisgICAqb3V0X2xlbiA9IGdfYmFzZTY0X2RlY29k ZV9zdGVwICh0ZXh0LCBpbnB1dF9sZW5ndGgsIHJldCwgJnN0YXRlLCAmc2F2ZSk7CisgICAKCmRp ZmYgLS1naXQgYS9nbGliMi5zcGVjIGIvZ2xpYjIuc3BlYwppbmRleCA5YmIwMGI1Li5iNTFmZWFj IDEwMDY0NAotLS0gYS9nbGliMi5zcGVjCisrKyBiL2dsaWIyLnNwZWMKQEAgLTMsNyArMyw3IEBA CiBTdW1tYXJ5OiBBIGxpYnJhcnkgb2YgaGFuZHkgdXRpbGl0eSBmdW5jdGlvbnMKIE5hbWU6IGds aWIyCiBWZXJzaW9uOiAyLjE5LjEwCi1SZWxlYXNlOiAxJXs/ZGlzdH0KK1JlbGVhc2U6IDIlez9k aXN0fQogTGljZW5zZTogTEdQTHYyKwogR3JvdXA6IFN5c3RlbSBFbnZpcm9ubWVudC9MaWJyYXJp ZXMKIFVSTDogaHR0cDovL3d3dy5ndGsub3JnCkBAIC0yMiwxMSArMjIsMTMgQEAgQnVpbGRSZXF1 aXJlczogZ2xpYmMtZGV2ZWwKICMgdGhpcyBwYXRjaCByZXF1aXJlcyBhdXRvcmVjb25mCiBCdWls ZFJlcXVpcmVzOiBhdXRvY29uZiBhdXRvbWFrZSBsaWJ0b29sIGdldHRleHQtZGV2ZWwgZ3RrLWRv YwogCi0lZGVzY3JpcHRpb24gCitQYXRjaDA6IGdsaWIyLUNWRS0yMDA4LTQzMTYucGF0Y2gKKwor JWRlc2NyaXB0aW9uCiBHTGliIGlzIHRoZSBsb3ctbGV2ZWwgY29yZSBsaWJyYXJ5IHRoYXQgZm9y bXMgdGhlIGJhc2lzCiBmb3IgcHJvamVjdHMgc3VjaCBhcyBHVEsrIGFuZCBHTk9NRS4gSXQgcHJv dmlkZXMgZGF0YSBzdHJ1Y3R1cmUKIGhhbmRsaW5nIGZvciBDLCBwb3J0YWJpbGl0eSB3cmFwcGVy cywgYW5kIGludGVyZmFjZXMgZm9yIHN1Y2ggcnVudGltZQotZnVuY3Rpb25hbGl0eSBhcyBhbiBl dmVudCBsb29wLCB0aHJlYWRzLCBkeW5hbWljIGxvYWRpbmcsIGFuZCBhbiAKK2Z1bmN0aW9uYWxp dHkgYXMgYW4gZXZlbnQgbG9vcCwgdGhyZWFkcywgZHluYW1pYyBsb2FkaW5nLCBhbmQgYW4KIG9i amVjdCBzeXN0ZW0uCiAKIFRoaXMgcGFja2FnZSBwcm92aWRlcyB2ZXJzaW9uIDIgb2YgR0xpYi4K QEAgLTM4LDggKzQwLDggQEAgUmVxdWlyZXM6IHBrZ2NvbmZpZyA+PSAxOjAuMTQKIFJlcXVpcmVz OiAle25hbWV9ID0gJXt2ZXJzaW9ufS0le3JlbGVhc2V9CiAKICVkZXNjcmlwdGlvbiBkZXZlbAot VGhlIGdsaWIyLWRldmVsIHBhY2thZ2UgaW5jbHVkZXMgdGhlIGhlYWRlciBmaWxlcyBmb3IgCi12 ZXJzaW9uIDIgb2YgdGhlIEdMaWIgbGlicmFyeS4gCitUaGUgZ2xpYjItZGV2ZWwgcGFja2FnZSBp bmNsdWRlcyB0aGUgaGVhZGVyIGZpbGVzIGZvcgordmVyc2lvbiAyIG9mIHRoZSBHTGliIGxpYnJh cnkuCiAKICMgYW5hY29uZGEgbmVlZHMgc3RhdGljIGxpYnMsIHNlZSBSSCBidWcgIzE5MzE0Mwog JXBhY2thZ2Ugc3RhdGljCkBAIC00OSwxNiArNTEsMTcgQEAgUmVxdWlyZXM6ICV7bmFtZX0tZGV2 ZWwgPSAle3ZlcnNpb259LSV7cmVsZWFzZX0KIAogJWRlc2NyaXB0aW9uIHN0YXRpYwogVGhlIGds aWIyLXN0YXRpYyBwYWNrYWdlIGluY2x1ZGVzIHN0YXRpYyBsaWJyYXJpZXMKLW9mIHZlcnNpb24g MiBvZiB0aGUgR0xpYiBsaWJyYXJ5LiAKK29mIHZlcnNpb24gMiBvZiB0aGUgR0xpYiBsaWJyYXJ5 LgogCiAlcHJlcAogJXNldHVwIC1xIC1uIGdsaWItJXt2ZXJzaW9ufQorJXBhdGNoMCAtcDEgLWIg LkNWRS0yMDA4LTQzMTYKIAogbGlidG9vbGl6ZSAtLWZvcmNlIC0tY29weQogYXV0b3JlY29uZgog CiAlYnVpbGQKLSVjb25maWd1cmUgLS1kaXNhYmxlLWd0ay1kb2MgLS1lbmFibGUtc3RhdGljIAor JWNvbmZpZ3VyZSAtLWRpc2FibGUtZ3RrLWRvYyAtLWVuYWJsZS1zdGF0aWMKIG1ha2UgJXs/X3Nt cF9tZmxhZ3N9CiAKICVpbnN0YWxsCkBAIC02Niw3ICs2OSw3IEBAIHJtIC1yZiAkUlBNX0JVSUxE X1JPT1QKIAogbWFrZSBpbnN0YWxsIERFU1RESVI9JFJQTV9CVUlMRF9ST09UCiAKLSMgd2UgYnVp bGQgaW50byAvdXNyL2xpYiwgYnV0IHdlIHdhbnQgdGhlIGxpYnJhcmllcyAoYnV0IG5vdCAKKyMg d2UgYnVpbGQgaW50byAvdXNyL2xpYiwgYnV0IHdlIHdhbnQgdGhlIGxpYnJhcmllcyAoYnV0IG5v dAogIyB0aGUgZGV2ZWwgc3R1ZmYpIGluIC9saWIKIC4vbWtpbnN0YWxsZGlycyAkUlBNX0JVSUxE X1JPT1QvJXtfbGlifQogcHVzaGQgJFJQTV9CVUlMRF9ST09UJXtfbGliZGlyfQpAQCAtMTIzLDYg KzEyNiw5IEBAIHJtIC1yZiAkUlBNX0JVSUxEX1JPT1QKICV7X2xpYmRpcn0vbGliKi5hCiAKICVj aGFuZ2Vsb2cKKyogVGh1IE1hciAxMiAyMDA5IE1hdHRoaWFzIENsYXNlbiA8bWNsYXNlbkByZWRo YXQuY29tPiAtIDIuMTkuMTAtMgorLSBGaXggaW50ZWdlciBvdmVyZmxvd3MgaW4gdGhlIGJhc2U2 NCBoYW5kbGluZyBmdW5jdGlvbnMuIENWRS0yMDA4LTQzMTYKKwogKiBNb24gTWFyICAyIDIwMDkg TWF0dGhpYXMgQ2xhc2VuIDxtY2xhc2VuQHJlZGhhdC5jb20+IC0gMi4xOS4xMC0xCiAtIFVwZGF0 ZSB0byAyLjE5LjEwCiAK