From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Thorsten Leemhuis To: git-commits@fedoraproject.org Subject: [rpms/glib2] cve-2026-58016-f44: Fix pidgin freezes by applying patch from master (#956872) Date: Tue, 11 Aug 2026 10:35:27 GMT Message-ID: <178644452759.1.5525025322431692521.rpms-glib2-7bf821108218@fedoraproject.org> List-ID: X-Git-Repo: rpms/glib2 X-Git-Branch: cve-2026-58016-f44 X-Git-Rev: 7bf82110821871096be94d5fbc9aa419ef789edb QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvZ2xpYjIKQnJhbmNo IDogY3ZlLTIwMjYtNTgwMTYtZjQ0CkNvbW1pdCA6IDdiZjgyMTEwODIxODcxMDk2YmU5NGQ1ZmJj OWFhNDE5ZWY3ODllZGIKQXV0aG9yIDogVGhvcnN0ZW4gTGVlbWh1aXMgPGZlZG9yYUBsZWVtaHVp cy5pbmZvPgpEYXRlICAgOiAyMDEzLTA0LTI5VDE4OjIxOjM3KzAyOjAwClN0YXRzICA6ICsxNDEv LTEgaW4gMiBmaWxlKHMpClVSTCAgICA6IGh0dHBzOi8vc3JjLmZlZG9yYXByb2plY3Qub3JnL3Jw bXMvZ2xpYjIvYy83YmY4MjExMDgyMTg3MTA5NmJlOTRkNWZiYzlhYTQxOWVmNzg5ZWRiP2JyYW5j aD1jdmUtMjAyNi01ODAxNi1mNDQKCkxvZzoKRml4IHBpZGdpbiBmcmVlemVzIGJ5IGFwcGx5aW5n IHBhdGNoIGZyb20gbWFzdGVyICgjOTU2ODcyKQoKLS0tCmRpZmYgLS1naXQgYS9nbGliMi1wYXJ0 aWFsbHlfcmV2ZXJ0X21lcmdlX3dhaXRwaWRfZnJvbV9nX3NwYXduX3N5bmNfaW50b19nbWFpbi5w YXRjaCBiL2dsaWIyLXBhcnRpYWxseV9yZXZlcnRfbWVyZ2Vfd2FpdHBpZF9mcm9tX2dfc3Bhd25f c3luY19pbnRvX2dtYWluLnBhdGNoCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAu Ljg0OGZmZWEKLS0tIC9kZXYvbnVsbAorKysgYi9nbGliMi1wYXJ0aWFsbHlfcmV2ZXJ0X21lcmdl X3dhaXRwaWRfZnJvbV9nX3NwYXduX3N5bmNfaW50b19nbWFpbi5wYXRjaApAQCAtMCwwICsxLDEz MyBAQAorRnJvbSBmM2IxMDU0YjBlYmI0OTEyZjcwMGUwOGRhMGMzZDM1YzMwMTEzZTc5IE1vbiBT ZXAgMTcgMDA6MDA6MDAgMjAwMQorRnJvbTogUnlhbiBMb3J0aWUgPGRlc3J0QGRlc3J0LmNhPgor RGF0ZTogVHVlLCAyMyBBcHIgMjAxMyAxNzoyNjo0OCArMDAwMAorU3ViamVjdDogUGFydGlhbGx5 IHJldmVydCAiTWVyZ2Ugd2FpdHBpZCgpIGZyb20gZ19zcGF3bl9zeW5jIGludG8gZ21haW4oKSIK KworVGhpcyBwYXJ0aWFsbHkgcmV2ZXJ0cyBjb21taXQgY2UwMDIyOTMzYzI1NTMxM2UwMTBiMjdm OTc3ZjRhZTAyYWFkMWU3ZS4KKworSXQgdXNlZCB0byBiZSBzYWZlIHRvIHVzZSBnX3NwYXduX3N5 bmMoKSBmcm9tIHByb2Nlc3NlcyB0aGF0IGhhZCB0aGVpcgorb3duIFNJR0NITEQgaGFuZGxlciBi ZWNhdXNlIGl0IHNpbXBseSBjYWxsZWQgd2FpdCgpLiAgV2hlbiBpdCB3YXMKK2NoYW5nZWQgdG8g ZGVwZW5kIG9uIHRoZSBHTGliIGNoaWxkIHdhdGNoaW5nIGluZnJhc3RydWN0dXJlIHRoaXMgbWVh bnQKK3RoYXQgR0xpYiBoYWQgdG8gb3duIHRoZSBTSUdDSExEIGhhbmRsZXIuCisKK1RoaXMgY2F1 c2VkIGhhbmdzIGluIGF0IGxlYXN0IFBpZGdpbi4KKworVGhlIHBhdGNoIGNvbnRhaW5lZCB0d28g b3RoZXIgaW1wcm92ZW1lbnRzIHRvIHRoZSBjaGlsZCB3YXRjaCBjb2RlIHdoaWNoCit3ZSB3YW50 IHRvIGtlZXAsIHNvIG9ubHkgcmV2ZXJ0IHRoZSBjaGFuZ2VzIHRvIGdzcGF3biBpdHNlbGYuCisK K2h0dHBzOi8vYnVnemlsbGEuZ25vbWUub3JnL3Nob3dfYnVnLmNnaT9pZD02OTgwODEKKy0tLQor ZGlmZiAtLWdpdCBhL2dsaWIvZ3NwYXduLmMgYi9nbGliL2dzcGF3bi5jCitpbmRleCAzODFlZDVj Li4wMWNlZGY2IDEwMDY0NAorLS0tIGEvZ2xpYi9nc3Bhd24uYworKysrIGIvZ2xpYi9nc3Bhd24u YworQEAgLTQ3LDcgKzQ3LDYgQEAKKyAKKyAjaW5jbHVkZSAiZ2Vudmlyb24uaCIKKyAjaW5jbHVk ZSAiZ21lbS5oIgorLSNpbmNsdWRlICJnbWFpbi5oIgorICNpbmNsdWRlICJnc2hlbGwuaCIKKyAj aW5jbHVkZSAiZ3N0cmluZy5oIgorICNpbmNsdWRlICJnc3RyZnVuY3MuaCIKK0BAIC0yMDcsMjEg KzIwNiw2IEBAIHJlYWRfZGF0YSAoR1N0cmluZyAqc3RyLAorICAgICB9CisgfQorIAorLXR5cGVk ZWYgc3RydWN0IHsKKy0gIEdNYWluTG9vcCAqbG9vcDsKKy0gIGdpbnQgKnN0YXR1c19wOworLX0g U3luY1dhaXRwaWREYXRhOworLQorLXN0YXRpYyB2b2lkCistb25fc3luY193YWl0cGlkIChHUGlk ICAgICBwaWQsCistICAgICAgICAgICAgICAgICBnaW50ICAgICBzdGF0dXMsCistICAgICAgICAg ICAgICAgICBncG9pbnRlciB1c2VyX2RhdGEpCisteworLSAgU3luY1dhaXRwaWREYXRhICpkYXRh ID0gdXNlcl9kYXRhOworLSAgKihkYXRhLT5zdGF0dXNfcCkgPSBzdGF0dXM7CistICBnX21haW5f bG9vcF9xdWl0IChkYXRhLT5sb29wKTsKKy19CistCisgLyoqCisgICogZ19zcGF3bl9zeW5jOgor ICAqIEB3b3JraW5nX2RpcmVjdG9yeTogKGFsbG93LW5vbmUpOiBjaGlsZCdzIGN1cnJlbnQgd29y a2luZyBkaXJlY3RvcnksIG9yICVOVUxMIHRvIGluaGVyaXQgcGFyZW50J3MKK0BAIC0yNzcsNyAr MjYxLDYgQEAgZ19zcGF3bl9zeW5jIChjb25zdCBnY2hhciAgICAgICAgICAqd29ya2luZ19kaXJl Y3RvcnksCisgICBHU3RyaW5nICplcnJzdHIgPSBOVUxMOworICAgZ2Jvb2xlYW4gZmFpbGVkOwor ICAgZ2ludCBzdGF0dXM7CistICBTeW5jV2FpdHBpZERhdGEgd2FpdHBpZF9kYXRhOworICAgCisg ICBnX3JldHVybl92YWxfaWZfZmFpbCAoYXJndiAhPSBOVUxMLCBGQUxTRSk7CisgICBnX3JldHVy bl92YWxfaWZfZmFpbCAoIShmbGFncyAmIEdfU1BBV05fRE9fTk9UX1JFQVBfQ0hJTEQpLCBGQUxT RSk7CitAQCAtNDEwLDMyICszOTMsNDUgQEAgZ19zcGF3bl9zeW5jIChjb25zdCBnY2hhciAgICAg ICAgICAqd29ya2luZ19kaXJlY3RvcnksCisgICAgIGNsb3NlX2FuZF9pbnZhbGlkYXRlICgmb3V0 cGlwZSk7CisgICBpZiAoZXJycGlwZSA+PSAwKQorICAgICBjbG9zZV9hbmRfaW52YWxpZGF0ZSAo JmVycnBpcGUpOworLQorLSAgLyogTm93IGNyZWF0ZSBhIHRlbXBvcmFyeSBtYWluIGNvbnRleHQg YW5kIGxvb3AsIHdpdGgganVzdCBvbmUKKy0gICAqIHdhaXRwaWQgc291cmNlLiAgV2UgdXNlZCB0 byBpbnZva2Ugd2FpdHBpZCgpIGRpcmVjdGx5IGhlcmUsIGJ1dAorLSAgICogdGhpcyB3YXkgd2Ug dW5pZnkgd2l0aCB0aGUgd29ya2VyIHRocmVhZCBpbiBnbWFpbi5jLgorKyAgCisrICAvKiBXYWl0 IGZvciBjaGlsZCB0byBleGl0LCBldmVuIGlmIHdlIGhhdmUKKysgICAqIGFuIGVycm9yIHBlbmRp bmcuCisgICAgKi8KKy0gIHsKKy0gICAgR01haW5Db250ZXh0ICpjb250ZXh0OworLSAgICBHTWFp bkxvb3AgKmxvb3A7CistICAgIEdTb3VyY2UgKnNvdXJjZTsKKy0KKy0gICAgY29udGV4dCA9IGdf bWFpbl9jb250ZXh0X25ldyAoKTsKKy0gICAgbG9vcCA9IGdfbWFpbl9sb29wX25ldyAoY29udGV4 dCwgVFJVRSk7CisrIGFnYWluOgorKyAgICAgIAorKyAgcmV0ID0gd2FpdHBpZCAocGlkLCAmc3Rh dHVzLCAwKTsKKyAKKy0gICAgd2FpdHBpZF9kYXRhLmxvb3AgPSBsb29wOworLSAgICB3YWl0cGlk X2RhdGEuc3RhdHVzX3AgPSAmc3RhdHVzOworLSAgICAKKy0gICAgc291cmNlID0gZ19jaGlsZF93 YXRjaF9zb3VyY2VfbmV3IChwaWQpOworLSAgICBnX3NvdXJjZV9zZXRfY2FsbGJhY2sgKHNvdXJj ZSwgKEdTb3VyY2VGdW5jKW9uX3N5bmNfd2FpdHBpZCwgJndhaXRwaWRfZGF0YSwgTlVMTCk7Cist ICAgIGdfc291cmNlX2F0dGFjaCAoc291cmNlLCBjb250ZXh0KTsKKy0gICAgZ19zb3VyY2VfdW5y ZWYgKHNvdXJjZSk7CistICAgIAorLSAgICBnX21haW5fbG9vcF9ydW4gKGxvb3ApOworKyAgaWYg KHJldCA8IDApCisrICAgIHsKKysgICAgICBpZiAoZXJybm8gPT0gRUlOVFIpCisrICAgICAgICBn b3RvIGFnYWluOworKyAgICAgIGVsc2UgaWYgKGVycm5vID09IEVDSElMRCkKKysgICAgICAgIHsK KysgICAgICAgICAgaWYgKGV4aXRfc3RhdHVzKQorKyAgICAgICAgICAgIHsKKysgICAgICAgICAg ICAgIGdfd2FybmluZyAoIkluIGNhbGwgdG8gZ19zcGF3bl9zeW5jKCksIGV4aXQgc3RhdHVzIG9m IGEgY2hpbGQgcHJvY2VzcyB3YXMgcmVxdWVzdGVkIGJ1dCBFQ0hJTEQgd2FzIHJlY2VpdmVkIGJ5 IHdhaXRwaWQoKS4gTW9zdCBsaWtlbHkgdGhlIHByb2Nlc3MgaXMgaWdub3JpbmcgU0lHQ0hMRCwg b3Igc29tZSBvdGhlciB0aHJlYWQgaXMgaW52b2tpbmcgd2FpdHBpZCgpIHdpdGggYSBub25wb3Np dGl2ZSBmaXJzdCBhcmd1bWVudDsgZWl0aGVyIGJlaGF2aW9yIGNhbiBicmVhayBhcHBsaWNhdGlv bnMgdGhhdCB1c2UgZ19zcGF3bl9zeW5jIGVpdGhlciBkaXJlY3RseSBvciBpbmRpcmVjdGx5LiIp OworKyAgICAgICAgICAgIH0KKysgICAgICAgICAgZWxzZQorKyAgICAgICAgICAgIHsKKysgICAg ICAgICAgICAgIC8qIFdlIGRvbid0IG5lZWQgdGhlIGV4aXQgc3RhdHVzLiAqLworKyAgICAgICAg ICAgIH0KKysgICAgICAgIH0KKysgICAgICBlbHNlCisrICAgICAgICB7CisrICAgICAgICAgIGlm ICghZmFpbGVkKSAvKiBhdm9pZCBlcnJvciBwaWxldXBzICovCisrICAgICAgICAgICAgeworKyAg ICAgICAgICAgICAgaW50IGVycnN2ID0gZXJybm87CisgCistICAgIGdfbWFpbl9jb250ZXh0X3Vu cmVmIChjb250ZXh0KTsKKy0gICAgZ19tYWluX2xvb3BfdW5yZWYgKGxvb3ApOworLSAgfQorKyAg ICAgICAgICAgICAgZmFpbGVkID0gVFJVRTsKKysgICAgICAgICAgICAgICAgICAKKysgICAgICAg ICAgICAgIGdfc2V0X2Vycm9yIChlcnJvciwKKysgICAgICAgICAgICAgICAgICAgICAgICAgICBH X1NQQVdOX0VSUk9SLAorKyAgICAgICAgICAgICAgICAgICAgICAgICAgIEdfU1BBV05fRVJST1Jf UkVBRCwKKysgICAgICAgICAgICAgICAgICAgICAgICAgICBfKCJVbmV4cGVjdGVkIGVycm9yIGlu IHdhaXRwaWQoKSAoJXMpIiksCisrICAgICAgICAgICAgICAgICAgICAgICAgICAgZ19zdHJlcnJv ciAoZXJyc3YpKTsKKysgICAgICAgICAgICB9CisrICAgICAgICB9CisrICAgIH0KKyAgIAorICAg aWYgKGZhaWxlZCkKKyAgICAgeworLS0KK2NnaXQgdjAuOS4xCisKCmRpZmYgLS1naXQgYS9nbGli Mi5zcGVjIGIvZ2xpYjIuc3BlYwppbmRleCBhNDgyNmJkLi41MWEzZjUxIDEwMDY0NAotLS0gYS9n bGliMi5zcGVjCisrKyBiL2dsaWIyLnNwZWMKQEAgLTEsMTIgKzEsMTUgQEAKIFN1bW1hcnk6IEEg bGlicmFyeSBvZiBoYW5keSB1dGlsaXR5IGZ1bmN0aW9ucwogTmFtZTogZ2xpYjIKIFZlcnNpb246 IDIuMzYuMQotUmVsZWFzZTogMSV7P2Rpc3R9CitSZWxlYXNlOiAyJXs/ZGlzdH0KIExpY2Vuc2U6 IExHUEx2MisKIEdyb3VwOiBTeXN0ZW0gRW52aXJvbm1lbnQvTGlicmFyaWVzCiBVUkw6IGh0dHA6 Ly93d3cuZ3RrLm9yZwogI1ZDUzogZ2l0OmdpdDovL2dpdC5nbm9tZS5vcmcvZ2xpYgogU291cmNl OiBodHRwOi8vZG93bmxvYWQuZ25vbWUub3JnL3NvdXJjZXMvZ2xpYi8yLjM2L2dsaWItJXt2ZXJz aW9ufS50YXIueHoKKyMgcGF0Y2gwIHdhcyBpcyBjb21taXQgZWI4NjBmZCBvbiBtYXN0ZXIgYW5k IGYzYjEwNTRiIGluIDIuMzYgCisjIGJhY2tncm91bmRzOiBodHRwczovL2J1Z3ppbGxhLmdub21l Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9Njk4MDgxCitQYXRjaDA6ICV7bmFtZX0tcGFydGlhbGx5X3Jl dmVydF9tZXJnZV93YWl0cGlkX2Zyb21fZ19zcGF3bl9zeW5jX2ludG9fZ21haW4ucGF0Y2gKIAog QnVpbGRSZXF1aXJlczogcGtnY29uZmlnCiBCdWlsZFJlcXVpcmVzOiBnZXR0ZXh0CkBAIC02NCw2 ICs2Nyw3IEBAIFRoZSBnbGliMi1mYW0gcGFja2FnZSBjb250YWlucyB0aGUgRkFNIChGaWxlIEFs dGVyYXRpb24gTW9uaXRvcikgbW9kdWxlIGZvciBHSU8uCiAKICVwcmVwCiAlc2V0dXAgLXEgLW4g Z2xpYi0le3ZlcnNpb259CislcGF0Y2gwIC1wMSAtYiAucGF0Y2gwCiAKICVidWlsZAogIyBTdXBw b3J0IGJ1aWxkcyBvZiBib3RoIGdpdCBzbmFwc2hvdHMgYW5kIHRhcmJhbGxzIHBhY2tlZCB3aXRo IGF1dG9nb28KQEAgLTE4NCw2ICsxODgsOSBAQCBnaW8tcXVlcnltb2R1bGVzLSV7X19pc2FfYml0 c30gJXtfbGliZGlyfS9naW8vbW9kdWxlcwogJXtfbGliZGlyfS9naW8vbW9kdWxlcy9saWJnaW9m YW0uc28KIAogJWNoYW5nZWxvZworKiBTYXQgQXByIDI3IDIwMTMgVGhvcnN0ZW4gTGVlbWh1aXMg PGZlZG9yYUBsZWVtaHVpcy5pbmZvPiAtIDIuMzYuMS0yCistIEZpeCBwaWRnaW4gZnJlZXplcyBi eSBhcHBseWluZyBwYXRjaCBmcm9tIG1hc3RlciAoIzk1Njg3MikKKwogKiBNb24gQXByIDE1IDIw MTMgS2FsZXYgTGVtYmVyIDxrYWxldmxlbWJlckBnbWFpbC5jb20+IC0gMi4zNi4xLTEKIC0gVXBk YXRlIHRvIDIuMzYuMQogCg==