From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Matthias Clasen To: git-commits@fedoraproject.org Subject: [rpms/glib2] cve-2026-58016-f44: fix a deadlock Date: Tue, 11 Aug 2026 10:34:52 GMT Message-ID: <178644449228.1.17160996161154768980.rpms-glib2-d590dacb3d22@fedoraproject.org> List-ID: X-Git-Repo: rpms/glib2 X-Git-Branch: cve-2026-58016-f44 X-Git-Rev: d590dacb3d22f94e3a0fd1676e006a64ae3a5c61 QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvZ2xpYjIKQnJhbmNo IDogY3ZlLTIwMjYtNTgwMTYtZjQ0CkNvbW1pdCA6IGQ1OTBkYWNiM2QyMmY5NGUzYTBmZDE2NzZl MDA2YTY0YWUzYTVjNjEKQXV0aG9yIDogTWF0dGhpYXMgQ2xhc2VuIDxtY2xhc2VuQHJlZGhhdC5j b20+CkRhdGUgICA6IDIwMTEtMDYtMDZUMjM6MzA6MjAtMDQ6MDAKU3RhdHMgIDogKzExNy8tMCBp biAyIGZpbGUocykKVVJMICAgIDogaHR0cHM6Ly9zcmMuZmVkb3JhcHJvamVjdC5vcmcvcnBtcy9n bGliMi9jL2Q1OTBkYWNiM2QyMmY5NGUzYTBmZDE2NzZlMDA2YTY0YWUzYTVjNjE/YnJhbmNoPWN2 ZS0yMDI2LTU4MDE2LWY0NAoKTG9nOgpmaXggYSBkZWFkbG9jawoKLS0tCmRpZmYgLS1naXQgYS8w MDAxLUdEYXRhTGlzdC1kb24tdC1ob2xkLXRoZS1iaXRsb2NrLW92ZXItY2FsbGJhY2tzLnBhdGNo IGIvMDAwMS1HRGF0YUxpc3QtZG9uLXQtaG9sZC10aGUtYml0bG9jay1vdmVyLWNhbGxiYWNrcy5w YXRjaApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi44YTUyOTkxCi0tLSAvZGV2 L251bGwKKysrIGIvMDAwMS1HRGF0YUxpc3QtZG9uLXQtaG9sZC10aGUtYml0bG9jay1vdmVyLWNh bGxiYWNrcy5wYXRjaApAQCAtMCwwICsxLDExMCBAQAorRnJvbSBjOTE3MjAyNTUyNjEyMjJkN2Jl Njg1ZjNhOGYwMzk3MDZmMDRjY2U1IE1vbiBTZXAgMTcgMDA6MDA6MDAgMjAwMQorRnJvbTogTWF0 dGhpYXMgQ2xhc2VuIDxtY2xhc2VuQHJlZGhhdC5jb20+CitEYXRlOiBNb24sIDYgSnVuIDIwMTEg MjM6MjM6MjkgLTA0MDAKK1N1YmplY3Q6IFtQQVRDSCAxLzJdIEdEYXRhTGlzdDogZG9uJ3QgaG9s ZCB0aGUgYml0bG9jayBvdmVyIGNhbGxiYWNrcworCitnX2RhdGFsaXN0X2lkX2NsZWFyX2kgd2Fz IGRyb3BwaW5nIHRoZSBkYXRhc2V0IGxvY2sgYXJvdW5kCit0aGUgZGVzdHJveSBub3RpZmllcywg YnV0IGtlcHQgdGhlIGJpdGxvY2suIFRoaXMgd2FzIGNhdXNpbmcKK2RlYWRsb2NrcyB3aGVuIGZp bmFsaXppbmcgd2lkZ2V0cy4KKy0tLQorIGdsaWIvZ2RhdGFzZXQuYyB8ICAgNDUgKysrKysrKysr KysrKysrKysrKysrKysrKysrKystLS0tLS0tLS0tLS0tLS0tCisgMSBmaWxlcyBjaGFuZ2VkLCAy OSBpbnNlcnRpb25zKCspLCAxNiBkZWxldGlvbnMoLSkKKworZGlmZiAtLWdpdCBhL2dsaWIvZ2Rh dGFzZXQuYyBiL2dsaWIvZ2RhdGFzZXQuYworaW5kZXggZTFiNTVjMS4uMGMxZjljMSAxMDA2NDQK Ky0tLSBhL2dsaWIvZ2RhdGFzZXQuYworKysrIGIvZ2xpYi9nZGF0YXNldC5jCitAQCAtMTc2LDgg KzE3Niw3IEBAIHN0cnVjdCBfR0RhdGFzZXQKKyAKKyAvKiAtLS0gcHJvdG90eXBlcyAtLS0gKi8K KyBzdGF0aWMgaW5saW5lIEdEYXRhc2V0KglnX2RhdGFzZXRfbG9va3VwCQkoZ2NvbnN0cG9pbnRl cgkgIGRhdGFzZXRfbG9jYXRpb24pOworLXN0YXRpYyBpbmxpbmUgdm9pZAlnX2RhdGFsaXN0X2Ns ZWFyX2kJCShHRGF0YQkJKipkYXRhbGlzdCwgCistCQkJCQkJCSBnYm9vbGVhbiAgICAgICAgIHVu bG9ja19kYXRhc2V0KTsKKytzdGF0aWMgaW5saW5lIHZvaWQJZ19kYXRhbGlzdF9jbGVhcl9pCQko R0RhdGEJCSoqZGF0YWxpc3QpOworIHN0YXRpYyB2b2lkCQlnX2RhdGFzZXRfZGVzdHJveV9pbnRl cm5hbAkoR0RhdGFzZXQJICpkYXRhc2V0KTsKKyBzdGF0aWMgaW5saW5lIGdwb2ludGVyCWdfZGF0 YV9zZXRfaW50ZXJuYWwJCShHRGF0YSAgICAgCSoqZGF0YWxpc3QsCisgCQkJCQkJCSBHUXVhcmsg ICAJICBrZXlfaWQsCitAQCAtMjI4LDggKzIyNyw4IEBAIGdfZGF0YWxpc3RfdW5sb2NrIChHRGF0 YSAqKmRhdGFsaXN0KQorIC8qIENhbGxlZCB3aXRoIHRoZSBkYXRhbGlzdCBsb2NrIGhlbGQsIG9y IHRoZSBkYXRhc2V0IGdsb2JhbAorICAqIGxvY2sgZm9yIGRhdGFzZXQgbGlzdHMKKyAgKi8KKy12 b2lkCistZ19kYXRhbGlzdF9jbGVhcl9pIChHRGF0YSAqKmRhdGFsaXN0LCBnYm9vbGVhbiB1bmxv Y2tfZGF0YXNldCkKKytzdGF0aWMgdm9pZAorK2dfZGF0YWxpc3RfY2xlYXJfaSAoR0RhdGEgKipk YXRhbGlzdCkKKyB7CisgICBHRGF0YSAqZGF0YTsKKyAgIGdpbnQgaTsKK0BAIC0yMzksMTUgKzIz OCwxMyBAQCBnX2RhdGFsaXN0X2NsZWFyX2kgKEdEYXRhICoqZGF0YWxpc3QsIGdib29sZWFuIHVu bG9ja19kYXRhc2V0KQorIAorICAgaWYgKGRhdGEpCisgICAgIHsKKy0gICAgICBpZiAodW5sb2Nr X2RhdGFzZXQpCistCUdfVU5MT0NLIChnX2RhdGFzZXRfZ2xvYmFsKTsKKysgICAgICBHX1VOTE9D SyAoZ19kYXRhc2V0X2dsb2JhbCk7CisgICAgICAgZm9yIChpID0gMDsgaSA8IGRhdGEtPmxlbjsg aSsrKQorLQl7CistCSAgaWYgKGRhdGEtPmRhdGFbaV0uZGF0YSAmJiBkYXRhLT5kYXRhW2ldLmRl c3Ryb3kpCistCSAgICBkYXRhLT5kYXRhW2ldLmRlc3Ryb3kgKGRhdGEtPmRhdGFbaV0uZGF0YSk7 CistCX0KKy0gICAgICBpZiAodW5sb2NrX2RhdGFzZXQpCistCUdfTE9DSyAoZ19kYXRhc2V0X2ds b2JhbCk7CisrICAgICAgICB7CisrICAgICAgICAgIGlmIChkYXRhLT5kYXRhW2ldLmRhdGEgJiYg ZGF0YS0+ZGF0YVtpXS5kZXN0cm95KQorKyAgICAgICAgICAgIGRhdGEtPmRhdGFbaV0uZGVzdHJv eSAoZGF0YS0+ZGF0YVtpXS5kYXRhKTsKKysgICAgICAgIH0KKysgICAgICBHX0xPQ0sgKGdfZGF0 YXNldF9nbG9iYWwpOworIAorICAgICAgIGdfZnJlZSAoZGF0YSk7CisgICAgIH0KK0BAIC0yNTgs MTkgKzI1NSwzNSBAQCBnX2RhdGFsaXN0X2NsZWFyX2kgKEdEYXRhICoqZGF0YWxpc3QsIGdib29s ZWFuIHVubG9ja19kYXRhc2V0KQorICAqIGdfZGF0YWxpc3RfY2xlYXI6CisgICogQGRhdGFsaXN0 OiBhIGRhdGFsaXN0LgorICAqCistICogRnJlZXMgYWxsIHRoZSBkYXRhIGVsZW1lbnRzIG9mIHRo ZSBkYXRhbGlzdC4gVGhlIGRhdGEgZWxlbWVudHMnCistICogZGVzdHJveSBmdW5jdGlvbnMgYXJl IGNhbGxlZCBpZiB0aGV5IGhhdmUgYmVlbiBzZXQuCisrICogRnJlZXMgYWxsIHRoZSBkYXRhIGVs ZW1lbnRzIG9mIHRoZSBkYXRhbGlzdC4KKysgKiBUaGUgZGF0YSBlbGVtZW50cycgZGVzdHJveSBm dW5jdGlvbnMgYXJlIGNhbGxlZAorKyAqIGlmIHRoZXkgaGF2ZSBiZWVuIHNldC4KKyAgKiovCisg dm9pZAorIGdfZGF0YWxpc3RfY2xlYXIgKEdEYXRhICoqZGF0YWxpc3QpCisgeworKyAgR0RhdGEg KmRhdGE7CisrICBnaW50IGk7CisrCisgICBnX3JldHVybl9pZl9mYWlsIChkYXRhbGlzdCAhPSBO VUxMKTsKKyAKKyAgIGdfZGF0YWxpc3RfbG9jayAoZGF0YWxpc3QpOworIAorLSAgZ19kYXRhbGlz dF9jbGVhcl9pIChkYXRhbGlzdCwgRkFMU0UpOworKyAgZGF0YSA9IEdfREFUQUxJU1RfR0VUX1BP SU5URVIgKGRhdGFsaXN0KTsKKysgIEdfREFUQUxJU1RfU0VUX1BPSU5URVIgKGRhdGFsaXN0LCBO VUxMKTsKKyAKKyAgIGdfZGF0YWxpc3RfdW5sb2NrIChkYXRhbGlzdCk7CisrCisrICBpZiAoZGF0 YSkKKysgICAgeworKyAgICAgIGZvciAoaSA9IDA7IGkgPCBkYXRhLT5sZW47IGkrKykKKysgICAg ICAgIHsKKysgICAgICAgICAgaWYgKGRhdGEtPmRhdGFbaV0uZGF0YSAmJiBkYXRhLT5kYXRhW2ld LmRlc3Ryb3kpCisrICAgICAgICAgICAgZGF0YS0+ZGF0YVtpXS5kZXN0cm95IChkYXRhLT5kYXRh W2ldLmRhdGEpOworKyAgICAgICAgfQorKworKyAgICAgIGdfZnJlZSAoZGF0YSk7CisrICAgIH0K KyB9CisgCisgLyogSE9MRFM6IGdfZGF0YXNldF9nbG9iYWxfbG9jayAqLworQEAgLTMwNyw3ICsz MjAsNyBAQCBnX2RhdGFzZXRfZGVzdHJveV9pbnRlcm5hbCAoR0RhdGFzZXQgKmRhdGFzZXQpCisg CSAgYnJlYWs7CisgCX0KKyAgICAgICAKKy0gICAgICBnX2RhdGFsaXN0X2NsZWFyX2kgKCZkYXRh c2V0LT5kYXRhbGlzdCwgVFJVRSk7CisrICAgICAgZ19kYXRhbGlzdF9jbGVhcl9pICgmZGF0YXNl dC0+ZGF0YWxpc3QpOworICAgICAgIGRhdGFzZXQgPSBnX2RhdGFzZXRfbG9va3VwIChkYXRhc2V0 X2xvY2F0aW9uKTsKKyAgICAgfQorIH0KKy0tIAorMS43LjUuMgorCgpkaWZmIC0tZ2l0IGEvZ2xp YjIuc3BlYyBiL2dsaWIyLnNwZWMKaW5kZXggNzU4MGY4Mi4uOTIwM2YzZCAxMDA2NDQKLS0tIGEv Z2xpYjIuc3BlYworKysgYi9nbGliMi5zcGVjCkBAIC0xMCw2ICsxMCw5IEBAIFVSTDogaHR0cDov L3d3dy5ndGsub3JnCiAjVkNTOiBnaXQ6Z2l0Oi8vZ2l0Lmdub21lLm9yZy9nbGliCiBTb3VyY2U6 IGh0dHA6Ly9kb3dubG9hZC5nbm9tZS5vcmcvc291cmNlcy9nbGliLzIuMjkvZ2xpYi0le3ZlcnNp b259LnRhci54egogCisjIHVwc3RyZWFtIGZpeAorUGF0Y2gwOiAwMDAxLUdEYXRhTGlzdC1kb24t dC1ob2xkLXRoZS1iaXRsb2NrLW92ZXItY2FsbGJhY2tzLnBhdGNoCisKIEJ1aWxkUmVxdWlyZXM6 IHBrZ2NvbmZpZwogQnVpbGRSZXF1aXJlczogZ2FtaW4tZGV2ZWwKIEJ1aWxkUmVxdWlyZXM6IGdl dHRleHQKQEAgLTU3LDYgKzYwLDcgQEAgVGhlIGdsaWIyLXN0YXRpYyBwYWNrYWdlIGluY2x1ZGVz IHN0YXRpYyBsaWJyYXJpZXMgb2YgdGhlIEdMaWIgbGlicmFyeS4KIAogJXByZXAKICVzZXR1cCAt cSAtbiBnbGliLSV7dmVyc2lvbn0KKyVwYXRjaCAtcDEgLWIgLmRhdGFsaXN0LWRlYWRsb2NrCiAK ICVidWlsZAogIyBTdXBwb3J0IGJ1aWxkcyBvZiBib3RoIGdpdCBzbmFwc2hvdHMgYW5kIHRhcmJh bGxzIHBhY2tlZCB3aXRoIGF1dG9nb28KQEAgLTE1OSw2ICsxNjMsOSBAQCBnaW8tcXVlcnltb2R1 bGVzLSV7X19pc2FfYml0c30gJXtfbGliZGlyfS9naW8vbW9kdWxlcwogCiAKICVjaGFuZ2Vsb2cK KyogTW9uIEp1biAgNiAyMDExIE1hdHRoaWFzIENsYXNlbiA8bWNsYXNlbkByZWRoYXQuY29tPiAt IDIuMjkuNi0yCistIEZpeCBhIGRlYWRsb2NrIHdoZW4gZmluYWxpemluZyBlLmcuIHdpZGdldHMK KwogKiBTdW4gSnVuICA1IDIwMTEgTWF0dGhpYXMgQ2xhc2VuIDxtY2xhc2VuQHJlZGhhdC5jb20+ IC0gMi4yOS42LTEKIC0gVXBkYXRlIHRvIDIuMjkuNgogCg==