From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Stephen Gallagher To: git-commits@fedoraproject.org Subject: [rpms/glib2] cve-2026-58016-f44: Fix GThreadPool initialization that is breaking createrepo_c (BZ #1795052) Date: Tue, 11 Aug 2026 10:36:55 GMT Message-ID: <178644461558.1.7162224140121814887.rpms-glib2-ab00509fe1bf@fedoraproject.org> List-ID: X-Git-Repo: rpms/glib2 X-Git-Branch: cve-2026-58016-f44 X-Git-Rev: ab00509fe1bf3f4e91242d0771bdc177da017d8c ICAgICAgICAgICAgQSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KCiAgICAgICAgICAgIFJl cG8gICA6IHJwbXMvZ2xpYjIKICAgICAgICAgICAgQnJhbmNoIDogY3ZlLTIwMjYtNTgwMTYtZjQ0 CiAgICAgICAgICAgIENvbW1pdCA6IGFiMDA1MDlmZTFiZjNmNGU5MTI0MmQwNzcxYmRjMTc3ZGEw MTdkOGMKICAgICAgICAgICAgQXV0aG9yIDogU3RlcGhlbiBHYWxsYWdoZXIgPHNnYWxsYWdoQHJl ZGhhdC5jb20+CiAgICAgICAgICAgIERhdGUgICA6IDIwMjAtMDEtMjlUMTA6MTE6NTQtMDU6MDAK ICAgICAgICAgICAgU3RhdHMgIDogKzEwOC8tMSBpbiAyIGZpbGUocykKICAgICAgICAgICAgVVJM ICAgIDogaHR0cHM6Ly9zcmMuZmVkb3JhcHJvamVjdC5vcmcvcnBtcy9nbGliMi9jL2FiMDA1MDlm ZTFiZjNmNGU5MTI0MmQwNzcxYmRjMTc3ZGEwMTdkOGM/YnJhbmNoPWN2ZS0yMDI2LTU4MDE2LWY0 NAoKICAgICAgICAgICAgTG9nOgogICAgICAgICAgICBGaXggR1RocmVhZFBvb2wgaW5pdGlhbGl6 YXRpb24gdGhhdCBpcyBicmVha2luZyBjcmVhdGVyZXBvX2MgKEJaICMxNzk1MDUyKQoKU2lnbmVk LW9mZi1ieTogU3RlcGhlbiBHYWxsYWdoZXIgPHNnYWxsYWdoQHJlZGhhdC5jb20+CgotLS0KZGlm ZiAtLWdpdCBhLzAwMDEtRml4LWluaXRpYWxpemF0aW9uLWxvZ2ljLW9mLUdUaHJlYWRQb29sLWlm LXRoZS1maXJzdC5wYXRjaCBiLzAwMDEtRml4LWluaXRpYWxpemF0aW9uLWxvZ2ljLW9mLUdUaHJl YWRQb29sLWlmLXRoZS1maXJzdC5wYXRjaApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAw MDAwLi41NjhhYzdiCi0tLSAvZGV2L251bGwKKysrIGIvMDAwMS1GaXgtaW5pdGlhbGl6YXRpb24t bG9naWMtb2YtR1RocmVhZFBvb2wtaWYtdGhlLWZpcnN0LnBhdGNoCkBAIC0wLDAgKzEsOTkgQEAK K0Zyb20gNzhiYWU4NWQyMTVlM2UxY2U3N2M4MjhjMjA3NWQyMTZlZGJjMzZmNiBNb24gU2VwIDE3 IDAwOjAwOjAwIDIwMDEKK0Zyb206ID0/VVRGLTg/cT9TZWJhc3RpYW49MjBEcj1DMz1CNmdlPz0g PHNlYmFzdGlhbkBjZW50cmljdWxhci5jb20+CitEYXRlOiBTYXQsIDI1IEphbiAyMDIwIDExOjA4 OjIyICswMjAwCitTdWJqZWN0OiBbUEFUQ0hdIEZpeCBpbml0aWFsaXphdGlvbiBsb2dpYyBvZiBH VGhyZWFkUG9vbCBpZiB0aGUgZmlyc3QgY3JlYXRlZAorIHBvb2wgaXMgYW4gZXhjbHVzaXZlIG9u ZQorCitQcmV2aW91c2x5IHdlIHdvdWxkIG9ubHkgZXZlciBydW4gdGhlIGluaXRpYWxpemF0aW9u IGNvZGUgb25jZSwgYnV0IHBhcnQKK29mIGl0IG9ubHkgaWYgYSBub24tZXhjbHVzaXZlIHBvb2wg d2FzIGNyZWF0ZWQuIFRoaXMgY2F1c2VkIHRoZSBzaGFyZWQKK3N0YXRlIHRvIGJlIGluY29uc2lz dGVudCBpZiB0aGUgZmlyc3QgcG9vbCB0byBiZSBjcmVhdGVkIHdhcyBleGNsdXNpdmUKK2FuZCB0 aGUgc2Vjb25kIG5vbi1leGNsdXNpdmUuCisKK0ZpeGVzIGh0dHBzOi8vZ2l0bGFiLmdub21lLm9y Zy9HTk9NRS9nbGliL2lzc3Vlcy8yMDEyCistLS0KKyBnbGliL2d0aHJlYWRwb29sLmMgfCA2NyAr KysrKysrKysrKysrKysrKysrKysrKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCisgMSBmaWxlIGNo YW5nZWQsIDMzIGluc2VydGlvbnMoKyksIDM0IGRlbGV0aW9ucygtKQorCitkaWZmIC0tZ2l0IGEv Z2xpYi9ndGhyZWFkcG9vbC5jIGIvZ2xpYi9ndGhyZWFkcG9vbC5jCitpbmRleCBkZDY1NDZiZTQ1 NjhjN2I4MTkxNDVkOGNiYzY2NTRjOWMxODJmNzY3Li5lZDM0ZmNkNTI1YjYzOTM3NjM2YWUzMWIx NDYxYWY4MzQxZTU3OGU1IDEwMDY0NAorLS0tIGEvZ2xpYi9ndGhyZWFkcG9vbC5jCisrKysgYi9n bGliL2d0aHJlYWRwb29sLmMKK0BAIC01NzksNDIgKzU3OSw0MSBAQCBnX3RocmVhZF9wb29sX25l dyAoR0Z1bmMgICAgICBmdW5jLAorIAorICAgR19MT0NLIChpbml0KTsKKyAgIGlmICghdW51c2Vk X3RocmVhZF9xdWV1ZSkKKy0gICAgeworICAgICAgIHVudXNlZF90aHJlYWRfcXVldWUgPSBnX2Fz eW5jX3F1ZXVlX25ldyAoKTsKKy0gICAgICAvKiBGb3IgdGhlIHZlcnkgZmlyc3Qgbm9uLWV4Y2x1 c2l2ZSB0aHJlYWQtcG9vbCB3ZSByZW1lbWJlciB0aGUgdGhyZWFkCistICAgICAgICogc2NoZWR1 bGVyIHNldHRpbmdzIG9mIHRoZSB0aHJlYWQgY3JlYXRpbmcgdGhlIHBvb2wsIGlmIHN1cHBvcnRl ZCBieQorLSAgICAgICAqIHRoZSBHVGhyZWFkIGltcGxlbWVudGF0aW9uLiBUaGlzIGlzIHRoZW4g dXNlZCBmb3IgbWFraW5nIHN1cmUgdGhhdAorLSAgICAgICAqIGFsbCB0aHJlYWRzIGNyZWF0ZWQg b24gdGhlIG5vbi1leGNsdXNpdmUgdGhyZWFkLXBvb2wgaGF2ZSB0aGUgc2FtZQorLSAgICAgICAq IHNjaGVkdWxlciBzZXR0aW5ncywgYW5kIG1vcmUgaW1wb3J0YW50bHkgZG9uJ3QganVzdCBpbmhl cml0IHRoZW0KKy0gICAgICAgKiBmcm9tIHRoZSB0aHJlYWQgdGhhdCBqdXN0IGhhcHBlbmVkIHRv IHB1c2ggYSBuZXcgdGFzayBhbmQgY2F1c2VkCistICAgICAgICogYSBuZXcgdGhyZWFkIHRvIGJl IGNyZWF0ZWQuCistICAgICAgICoKKy0gICAgICAgKiBOb3QgZG9pbmcgc28gY291bGQgY2F1c2Ug cmVhbC10aW1lIHByaW9yaXR5IHRocmVhZHMgb3Igb3RoZXJ3aXNlCistICAgICAgICogdGhyZWFk cyB3aXRoIHByb2JsZW1hdGljIHNjaGVkdWxlciBzZXR0aW5ncyB0byBiZSBwYXJ0IG9mIHRoZQor LSAgICAgICAqIG5vbi1leGNsdXNpdmUgdGhyZWFkLXBvb2xzLgorLSAgICAgICAqCistICAgICAg ICogSWYgdGhpcyBpcyBub3Qgc3VwcG9ydGVkIGJ5IHRoZSBHVGhyZWFkIGltcGxlbWVudGF0aW9u IHRoZW4gd2UgaGVyZQorLSAgICAgICAqIHN0YXJ0IGEgdGhyZWFkIHRoYXQgd2lsbCBpbmhlcml0 IHRoZSBzY2hlZHVsZXIgc2V0dGluZ3MgZnJvbSB0aGlzCistICAgICAgICogdmVyeSB0aHJlYWQg YW5kIHdob3NlIG9ubHkgcHVycG9zZSBpcyB0byBzcGF3biBuZXcgdGhyZWFkcyB3aXRoIHRoZQor LSAgICAgICAqIHNhbWUgc2V0dGluZ3MgZm9yIHVzZSBieSB0aGUgbm9uLWV4Y2x1c2l2ZSB0aHJl YWQtcG9vbHMuCistICAgICAgICoKKy0gICAgICAgKgorLSAgICAgICAqIEZvciBub24tZXhjbHVz aXZlIHRocmVhZC1wb29scyB0aGlzIGlzIG5vdCByZXF1aXJlZCBhcyBhbGwgdGhyZWFkcworLSAg ICAgICAqIGFyZSBjcmVhdGVkIGltbWVkaWF0ZWx5IGJlbG93IGFuZCBhcmUgcnVubmluZyBmb3Jl dmVyLCBzbyB0aGV5IHdpbGwKKy0gICAgICAgKiBhdXRvbWF0aWNhbGx5IGluaGVyaXQgdGhlIHNj aGVkdWxlciBzZXR0aW5ncyBmcm9tIHRoaXMgdmVyeSB0aHJlYWQuCistICAgICAgICovCistICAg ICAgaWYgKCFleGNsdXNpdmUpCisrCisrICAvKiBGb3IgdGhlIHZlcnkgZmlyc3Qgbm9uLWV4Y2x1 c2l2ZSB0aHJlYWQtcG9vbCB3ZSByZW1lbWJlciB0aGUgdGhyZWFkCisrICAgKiBzY2hlZHVsZXIg c2V0dGluZ3Mgb2YgdGhlIHRocmVhZCBjcmVhdGluZyB0aGUgcG9vbCwgaWYgc3VwcG9ydGVkIGJ5 CisrICAgKiB0aGUgR1RocmVhZCBpbXBsZW1lbnRhdGlvbi4gVGhpcyBpcyB0aGVuIHVzZWQgZm9y IG1ha2luZyBzdXJlIHRoYXQKKysgICAqIGFsbCB0aHJlYWRzIGNyZWF0ZWQgb24gdGhlIG5vbi1l eGNsdXNpdmUgdGhyZWFkLXBvb2wgaGF2ZSB0aGUgc2FtZQorKyAgICogc2NoZWR1bGVyIHNldHRp bmdzLCBhbmQgbW9yZSBpbXBvcnRhbnRseSBkb24ndCBqdXN0IGluaGVyaXQgdGhlbQorKyAgICog ZnJvbSB0aGUgdGhyZWFkIHRoYXQganVzdCBoYXBwZW5lZCB0byBwdXNoIGEgbmV3IHRhc2sgYW5k IGNhdXNlZAorKyAgICogYSBuZXcgdGhyZWFkIHRvIGJlIGNyZWF0ZWQuCisrICAgKgorKyAgICog Tm90IGRvaW5nIHNvIGNvdWxkIGNhdXNlIHJlYWwtdGltZSBwcmlvcml0eSB0aHJlYWRzIG9yIG90 aGVyd2lzZQorKyAgICogdGhyZWFkcyB3aXRoIHByb2JsZW1hdGljIHNjaGVkdWxlciBzZXR0aW5n cyB0byBiZSBwYXJ0IG9mIHRoZQorKyAgICogbm9uLWV4Y2x1c2l2ZSB0aHJlYWQtcG9vbHMuCisr ICAgKgorKyAgICogSWYgdGhpcyBpcyBub3Qgc3VwcG9ydGVkIGJ5IHRoZSBHVGhyZWFkIGltcGxl bWVudGF0aW9uIHRoZW4gd2UgaGVyZQorKyAgICogc3RhcnQgYSB0aHJlYWQgdGhhdCB3aWxsIGlu aGVyaXQgdGhlIHNjaGVkdWxlciBzZXR0aW5ncyBmcm9tIHRoaXMKKysgICAqIHZlcnkgdGhyZWFk IGFuZCB3aG9zZSBvbmx5IHB1cnBvc2UgaXMgdG8gc3Bhd24gbmV3IHRocmVhZHMgd2l0aCB0aGUK KysgICAqIHNhbWUgc2V0dGluZ3MgZm9yIHVzZSBieSB0aGUgbm9uLWV4Y2x1c2l2ZSB0aHJlYWQt cG9vbHMuCisrICAgKgorKyAgICoKKysgICAqIEZvciBub24tZXhjbHVzaXZlIHRocmVhZC1wb29s cyB0aGlzIGlzIG5vdCByZXF1aXJlZCBhcyBhbGwgdGhyZWFkcworKyAgICogYXJlIGNyZWF0ZWQg aW1tZWRpYXRlbHkgYmVsb3cgYW5kIGFyZSBydW5uaW5nIGZvcmV2ZXIsIHNvIHRoZXkgd2lsbAor KyAgICogYXV0b21hdGljYWxseSBpbmhlcml0IHRoZSBzY2hlZHVsZXIgc2V0dGluZ3MgZnJvbSB0 aGlzIHZlcnkgdGhyZWFkLgorKyAgICovCisrICBpZiAoIWV4Y2x1c2l2ZSAmJiAhaGF2ZV9zaGFy ZWRfdGhyZWFkX3NjaGVkdWxlcl9zZXR0aW5ncyAmJiAhc3Bhd25fdGhyZWFkX3F1ZXVlKQorKyAg ICB7CisrICAgICAgaWYgKGdfdGhyZWFkX2dldF9zY2hlZHVsZXJfc2V0dGluZ3MgKCZzaGFyZWRf dGhyZWFkX3NjaGVkdWxlcl9zZXR0aW5ncykpCisgICAgICAgICB7CistICAgICAgICAgIGlmIChn X3RocmVhZF9nZXRfc2NoZWR1bGVyX3NldHRpbmdzICgmc2hhcmVkX3RocmVhZF9zY2hlZHVsZXJf c2V0dGluZ3MpKQorLSAgICAgICAgICAgIHsKKy0gICAgICAgICAgICAgIGhhdmVfc2hhcmVkX3Ro cmVhZF9zY2hlZHVsZXJfc2V0dGluZ3MgPSBUUlVFOworLSAgICAgICAgICAgIH0KKy0gICAgICAg ICAgZWxzZQorLSAgICAgICAgICAgIHsKKy0gICAgICAgICAgICAgIHNwYXduX3RocmVhZF9xdWV1 ZSA9IGdfYXN5bmNfcXVldWVfbmV3ICgpOworLSAgICAgICAgICAgICAgZ19jb25kX2luaXQgKCZz cGF3bl90aHJlYWRfY29uZCk7CistICAgICAgICAgICAgICBnX3RocmVhZF9uZXcgKCJwb29sLXNw YXduZXIiLCBnX3RocmVhZF9wb29sX3NwYXduX3RocmVhZCwgTlVMTCk7CistICAgICAgICAgICAg fQorKyAgICAgICAgICBoYXZlX3NoYXJlZF90aHJlYWRfc2NoZWR1bGVyX3NldHRpbmdzID0gVFJV RTsKKysgICAgICAgIH0KKysgICAgICBlbHNlCisrICAgICAgICB7CisrICAgICAgICAgIHNwYXdu X3RocmVhZF9xdWV1ZSA9IGdfYXN5bmNfcXVldWVfbmV3ICgpOworKyAgICAgICAgICBnX2NvbmRf aW5pdCAoJnNwYXduX3RocmVhZF9jb25kKTsKKysgICAgICAgICAgZ190aHJlYWRfbmV3ICgicG9v bC1zcGF3bmVyIiwgZ190aHJlYWRfcG9vbF9zcGF3bl90aHJlYWQsIE5VTEwpOworICAgICAgICAg fQorICAgICB9CisgICBHX1VOTE9DSyAoaW5pdCk7CistLSAKKzIuMjQuMQorCgpkaWZmIC0tZ2l0 IGEvZ2xpYjIuc3BlYyBiL2dsaWIyLnNwZWMKaW5kZXggZTU3OTRmZC4uMTU1NDE1NCAxMDA2NDQK LS0tIGEvZ2xpYjIuc3BlYworKysgYi9nbGliMi5zcGVjCkBAIC0yLDcgKzIsNyBAQAogCiBOYW1l OiBnbGliMgogVmVyc2lvbjogMi42My40Ci1SZWxlYXNlOiAyJXs/ZGlzdH0KK1JlbGVhc2U6IDMl ez9kaXN0fQogU3VtbWFyeTogQSBsaWJyYXJ5IG9mIGhhbmR5IHV0aWxpdHkgZnVuY3Rpb25zCiAK IExpY2Vuc2U6IExHUEx2MisKQEAgLTM1LDYgKzM1LDExIEBAIFJlY29tbWVuZHM6IHNoYXJlZC1t aW1lLWluZm8KICMgZ2xpYiAyLjU5LjAgaGFzaCB0YWJsZSBjaGFuZ2VzIGJyb2tlIG9sZGVyIGdj ciB2ZXJzaW9ucyAvIHBhc3N3b3JkIHByb21wdHMgaW4gZ25vbWUtc2hlbGwKIENvbmZsaWN0czog Z2NyIDwgMy4yOC4xCiAKKyMgUGF0Y2hlcyBmcm9tIHVwc3RyZWFtCisKKyMgRml4IGZvciBodHRw czovL2dpdGxhYi5nbm9tZS5vcmcvR05PTUUvZ2xpYi9pc3N1ZXMvMjAxMgorUGF0Y2gwMDAxOiAw MDAxLUZpeC1pbml0aWFsaXphdGlvbi1sb2dpYy1vZi1HVGhyZWFkUG9vbC1pZi10aGUtZmlyc3Qu cGF0Y2gKKwogJWRlc2NyaXB0aW9uCiBHTGliIGlzIHRoZSBsb3ctbGV2ZWwgY29yZSBsaWJyYXJ5 IHRoYXQgZm9ybXMgdGhlIGJhc2lzIGZvciBwcm9qZWN0cwogc3VjaCBhcyBHVEsrIGFuZCBHTk9N RS4gSXQgcHJvdmlkZXMgZGF0YSBzdHJ1Y3R1cmUgaGFuZGxpbmcgZm9yIEMsCkBAIC0yMTYsNiAr MjIxLDkgQEAgZ2xpYi1jb21waWxlLXNjaGVtYXMgJXtfZGF0YWRpcn0vZ2xpYi0yLjAvc2NoZW1h cyAmPiAvZGV2L251bGwgfHwgOgogJXtfZGF0YWRpcn0vaW5zdGFsbGVkLXRlc3RzCiAKICVjaGFu Z2Vsb2cKKyogV2VkIEphbiAyOSAyMDIwIFN0ZXBoZW4gR2FsbGFnaGVyIDxzZ2FsbGFnaEByZWRo YXQuY29tPiAtIDIuNjMuNC0zCistIEZpeCBHVGhyZWFkUG9vbCBpbml0aWFsaXphdGlvbiB0aGF0 IGlzIGJyZWFraW5nIGNyZWF0ZXJlcG9fYyAoQlogIzE3OTUwNTIpCisKICogVHVlIEphbiAyOCAy MDIwIEZlZG9yYSBSZWxlYXNlIEVuZ2luZWVyaW5nIDxyZWxlbmdAZmVkb3JhcHJvamVjdC5vcmc+ IC0gMi42My40LTIKIC0gUmVidWlsdCBmb3IgaHR0cHM6Ly9mZWRvcmFwcm9qZWN0Lm9yZy93aWtp L0ZlZG9yYV8zMl9NYXNzX1JlYnVpbGQKIAo=