[rpms/glib2] cve-2026-58016-f44: - Backport a patch from git master to avoid a segfault when doing the

[rpms/glib2] cve-2026-58016-f44: - Backport a patch from git master to avoid a segfault when doing the

[Richard Hughes]

        A new commit has been pushed.

        Repo   : rpms/glib2
        Branch : cve-2026-58016-f44
        Commit : bf0da4ed34e96d1666803007745377611977dba4
        Author : Richard Hughes <rhughes@fedoraproject.org>
        Date   : 2010-06-22T08:54:41+00:00
        Stats  : +45/-1 in 2 file(s)
        URL    : https://src.fedoraproject.org/rpms/glib2/c/bf0da4ed34e96d1666803007745377611977dba4?branch=cve-2026-58016-f44

        Log:
        - Backport a patch from git master to avoid a segfault when doing the
schema file check for several GNOME projects.

---
diff --git a/0003-Fix-bug-in-strinfo.patch b/0003-Fix-bug-in-strinfo.patch
new file mode 100644
index 0000000..818c1f7
--- /dev/null
+++ b/0003-Fix-bug-in-strinfo.patch
@@ -0,0 +1,36 @@
+From a7689537605ade51b19be76baa3fba303527483d Mon Sep 17 00:00:00 2001
+From: Ryan Lortie <desrt@desrt.ca>
+Date: Sat, 19 Jun 2010 11:38:57 -0400
+Subject: [PATCH 03/45] Fix bug in strinfo
+
+We can't search for a larger needle inside of a smaller haystack, and
+unsigned integer subtraction tends to result in very large numbers
+rather than small ones.
+
+Add a check for this case and abort out immediately.
+
+Also add a test case (lifted directly from the docs) that demonstrates
+the problem.
+
+Issue discovered and tracked down by Milan Bouchet-Valat
+---
+ gio/strinfo.c                                |    3 ++
+ gio/tests/gschema-compile.c                  |    3 +-
+ gio/tests/schema-tests/from-docs.gschema.xml |   34 ++++++++++++++++++++++++++
+ 3 files changed, 39 insertions(+), 1 deletions(-)
+ create mode 100644 gio/tests/schema-tests/from-docs.gschema.xml
+
+diff --git a/gio/strinfo.c b/gio/strinfo.c
+index 9ba18aa..f762fc5 100644
+--- a/gio/strinfo.c
++++ b/gio/strinfo.c
+@@ -147,6 +147,9 @@ strinfo_scan (const guint32 *strinfo,
+ {
+   guint i = 0;
+ 
++  if (length < n_words)
++    return -1;
++
+   while (i <= length - n_words)
+     {
+       guint j = 0;

diff --git a/glib2.spec b/glib2.spec
index 0ccab1a..82ec04c 100644
--- a/glib2.spec
+++ b/glib2.spec
@@ -3,7 +3,7 @@
 Summary: A library of handy utility functions
 Name: glib2
 Version: 2.25.9
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: LGPLv2+
 Group: System Environment/Libraries
 URL: http://www.gtk.org
@@ -26,6 +26,9 @@ BuildRequires: gtk-doc
 # required for GIO content-type support
 Requires: shared-mime-info
 
+# already upstream
+Patch1: 0003-Fix-bug-in-strinfo.patch
+
 %description
 GLib is the low-level core library that forms the basis for projects
 such as GTK+ and GNOME. It provides data structure handling for C,
@@ -52,6 +55,7 @@ The glib2-static package includes static libraries of the GLib library.
 
 %prep
 %setup -q -n glib-%{version}
+%patch1 -p1 -b .strinfo-bug
 
 %build
 %configure --disable-gtk-doc \
@@ -161,6 +165,10 @@ gio-querymodules-%{__isa_bits} %{_libdir}/gio/modules
 %{_libdir}/lib*.a
 
 %changelog
+* Tue Jun 22 2010 Richard Hughes <rhughes@redhat.com> - 2.25.9-2
+- Backport a patch from git master to avoid a segfault when doing the
+  schema file check for several GNOME projects.
+
 * Fri Jun 18 2010 Matthias Clasen <mclasen@redhat.com> - 2.25.9-1
 - Update to 2.25.9