[rpms/glib2] cve-2026-58016-f44: Update to 2.67.3

[rpms/glib2] cve-2026-58016-f44: Update to 2.67.3

[Kalev Lember]

            A new commit has been pushed.

            Repo   : rpms/glib2
            Branch : cve-2026-58016-f44
            Commit : 2165f81e6bc1514578a0e3ab042c49c475a065d7
            Author : Kalev Lember <klember@redhat.com>
            Date   : 2021-02-04T21:22:15+01:00
            Stats  : +19/-144 in 4 file(s)
            URL    : https://src.fedoraproject.org/rpms/glib2/c/2165f81e6bc1514578a0e3ab042c49c475a065d7?branch=cve-2026-58016-f44

            Log:
            Update to 2.67.3

... and rebase gnutls-hmac.patch

---
diff --git a/1786.patch b/1786.patch
deleted file mode 100644
index c9f534f..0000000
--- a/1786.patch
+++ /dev/null
@@ -1,127 +0,0 @@
-From a2de4b24792e6aa62821bceeb5f60ea83a551c4a Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
-Date: Tue, 8 Dec 2020 18:09:50 +0200
-Subject: [PATCH 1/2] Clarify in g_object_weak_ref() docs that the callback is
- called during disposing and not finalizing
-
-This especially has the effect that any GWeakRefs to the object will not
-necessarily be set to NULL yet if called as part of
-g_object_run_dispose() and not as part of g_object_unref().
----
- gobject/gobject.c | 2 +-
- gobject/gobject.h | 4 ++--
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/gobject/gobject.c b/gobject/gobject.c
-index 863d5b67a..2617dca3e 100644
---- a/gobject/gobject.c
-+++ b/gobject/gobject.c
-@@ -2975,7 +2975,7 @@ weak_refs_notify (gpointer data)
-  * @data: extra data to pass to notify
-  *
-  * Adds a weak reference callback to an object. Weak references are
-- * used for notification when an object is finalized. They are called
-+ * used for notification when an object is disposed. They are called
-  * "weak references" because they allow you to safely hold a pointer
-  * to an object without calling g_object_ref() (g_object_ref() adds a
-  * strong reference, that is, forces the object to stay alive).
-diff --git a/gobject/gobject.h b/gobject/gobject.h
-index a84c183f8..aec8975e4 100644
---- a/gobject/gobject.h
-+++ b/gobject/gobject.h
-@@ -227,11 +227,11 @@ typedef void (*GObjectFinalizeFunc)     (GObject      *object);
- /**
-  * GWeakNotify:
-  * @data: data that was provided when the weak reference was established
-- * @where_the_object_was: the object being finalized
-+ * @where_the_object_was: the object being disposed
-  * 
-  * A #GWeakNotify function can be added to an object as a callback that gets
-  * triggered when the object is finalized. Since the object is already being
-- * finalized when the #GWeakNotify is called, there's not much you could do 
-+ * disposed when the #GWeakNotify is called, there's not much you could do 
-  * with the object, apart from e.g. using its address as hash-index or the like. 
-  */
- typedef void (*GWeakNotify)		(gpointer      data,
--- 
-GitLab
-
-
-From e82eb490fea312ebe30e117288fc2e3bf2378a25 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
-Date: Tue, 8 Dec 2020 18:36:16 +0200
-Subject: [PATCH 2/2] Handle the case of g_object_run_dispose() in GBinding
-
-When this is called on the source or target, the weak notify of the
-corresponding object is called without the GWeakRef being cleared.
-See https://gitlab.gnome.org/GNOME/glib/-/issues/2266 for that issue.
-
-This means that a strong reference to these zombie objects can be
-retrieved from the GWeakRefs and the previous assumption that this can't
-happen was wrong. Remove the assertion for that accordingly and handle
-this case.
-
-Specifically, all signal handlers and weak notifies of the object are
-already gone and must not be disconnected/removed a second time, or
-otherwise memory corruption would be caused. Instead just set the
-GWeakRef to NULL and handle it otherwise as if the GWeakRef didn't give
-a strong reference to begin with.
-
-Fixes https://gitlab.gnome.org/GNOME/glib/-/issues/2265
----
- gobject/gbinding.c | 31 +++++++++++++++++++++++--------
- 1 file changed, 23 insertions(+), 8 deletions(-)
-
-diff --git a/gobject/gbinding.c b/gobject/gbinding.c
-index 562f339da..48b4fbaec 100644
---- a/gobject/gbinding.c
-+++ b/gobject/gbinding.c
-@@ -388,11 +388,30 @@ weak_unbind (gpointer  user_data,
-   target = g_weak_ref_get (&context->target);
- 
-   /* If this is called then either the source or target or both must be in the
--   * process of being finalized and their weak reference must be reset to NULL
--   * already.
-+   * process of being disposed. If this happens as part of g_object_unref()
-+   * then the weak references are actually cleared, otherwise if disposing
-+   * happens as part of g_object_run_dispose() then they would still point to
-+   * the disposed object.
-    *
--   * If source==target then both will always be NULL here. */
--  g_assert (source == NULL || target == NULL);
-+   * If the object this is being called for is either the source or the target
-+   * and we actually got a strong reference to it nonetheless (see above),
-+   * then signal handlers and weak notifies for it are already disconnected
-+   * and they must not be disconnected a second time. Instead simply clear the
-+   * weak reference and be done with it.
-+   *
-+   * See https://gitlab.gnome.org/GNOME/glib/-/issues/2266 */
-+
-+  if (source == where_the_object_was)
-+    {
-+      g_weak_ref_set (&context->source, NULL);
-+      g_clear_object (&source);
-+    }
-+
-+  if (target == where_the_object_was)
-+    {
-+      g_weak_ref_set (&context->target, NULL);
-+      g_clear_object (&target);
-+    }
- 
-   binding_was_removed = unbind_internal_locked (context, binding, source, target);
- 
-@@ -627,10 +646,6 @@ g_binding_unbind_internal (GBinding *binding,
-   source = g_weak_ref_get (&context->source);
-   target = g_weak_ref_get (&context->target);
- 
--  /* If the binding was removed previously, source and target are both NULL.
--   * Otherwise both will not be NULL. */
--  g_assert ((source == NULL && target == NULL) || (source != NULL && target != NULL));
--
-   binding_was_removed = unbind_internal_locked (context, binding, source, target);
- 
-   g_mutex_unlock (&binding->unbind_lock);
--- 
-GitLab
-

diff --git a/glib2.spec b/glib2.spec
index f87419b..4dab614 100644
--- a/glib2.spec
+++ b/glib2.spec
@@ -1,6 +1,6 @@
 Name: glib2
-Version: 2.67.1
-Release: 4%{?dist}
+Version: 2.67.3
+Release: 1%{?dist}
 Summary: A library of handy utility functions
 
 License: LGPLv2+
@@ -11,8 +11,6 @@ Source0: http://download.gnome.org/sources/glib/2.67/glib-%{version}.tar.xz
 # https://gitlab.gnome.org/GNOME/glib/-/merge_requests/903
 Patch0: gnutls-hmac.patch
 
-Patch1: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/1786.patch
-
 # For gnutls-hmac.patch
 BuildRequires: pkgconfig(gnutls)
 
@@ -229,6 +227,9 @@ glib-compile-schemas %{_datadir}/glib-2.0/schemas &> /dev/null || :
 %{_datadir}/installed-tests
 
 %changelog
+* Thu Feb 04 2021 Kalev Lember <klember@redhat.com> - 2.67.3-1
+- Update to 2.67.3
+
 * Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.67.1-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
 

diff --git a/gnutls-hmac.patch b/gnutls-hmac.patch
index bd974d5..5d193f4 100644
--- a/gnutls-hmac.patch
+++ b/gnutls-hmac.patch
@@ -1,4 +1,4 @@
-From afb5735506e2ed1c638a8c916aa3748bf0615f32 Mon Sep 17 00:00:00 2001
+From 12e9cd51eb0ef07c3554cd035f92d8b7b5b82304 Mon Sep 17 00:00:00 2001
 From: Colin Walters <walters@verbum.org>
 Date: Fri, 7 Jun 2019 18:44:43 +0000
 Subject: [PATCH 1/2] ghmac: Split off wrapper functions into ghmac-utils.c
@@ -284,7 +284,7 @@ index 49fd272f0..4f181f21f 100644
 -                                  (const guchar *) str, length);
 -}
 diff --git a/glib/meson.build b/glib/meson.build
-index aaf40a218..b3bf067c7 100644
+index 8c18e6de4..329b8d197 100644
 --- a/glib/meson.build
 +++ b/glib/meson.build
 @@ -253,6 +253,7 @@ glib_sources = files(
@@ -296,10 +296,10 @@ index aaf40a218..b3bf067c7 100644
    'ghostutils.c',
    'giochannel.c',
 -- 
-2.28.0
+2.29.2
 
 
-From 703e63f9d8b3ea4f26f41f0d2287b301025a73cc Mon Sep 17 00:00:00 2001
+From 231ed985074af4a354405cf1961fabf9c60bce43 Mon Sep 17 00:00:00 2001
 From: Colin Walters <walters@verbum.org>
 Date: Fri, 7 Jun 2019 19:36:54 +0000
 Subject: [PATCH 2/2] Add a gnutls backend for GHmac
@@ -332,7 +332,7 @@ developed this patch.
  create mode 100644 glib/ghmac-gnutls.c
 
 diff --git a/glib/gchecksum.c b/glib/gchecksum.c
-index f8a3f9ab8..b391a6264 100644
+index 29b479bc6..929958c3a 100644
 --- a/glib/gchecksum.c
 +++ b/glib/gchecksum.c
 @@ -20,7 +20,7 @@
@@ -589,7 +589,7 @@ index 4f181f21f..c62d9ce4e 100644
  /**
   * SECTION:hmac
 diff --git a/glib/meson.build b/glib/meson.build
-index b3bf067c7..3cdc3b573 100644
+index 329b8d197..2942a7e9b 100644
 --- a/glib/meson.build
 +++ b/glib/meson.build
 @@ -252,7 +252,6 @@ glib_sources = files(
@@ -625,16 +625,16 @@ index b3bf067c7..3cdc3b573 100644
    # intl.lib is not compatible with SAFESEH
    link_args : [noseh_link_args, glib_link_flags, win32_ldflags],
    include_directories : configinc,
--  dependencies : pcre_deps + [thread_dep, librt] + libintl_deps + libiconv + platform_deps + gnulib_libm_dependency + [libsysprof_capture_dep],
-+  dependencies : pcre_deps + libgnutls_dep + [thread_dep, librt] + libintl_deps + libiconv + platform_deps + gnulib_libm_dependency + [libsysprof_capture_dep],
+-  dependencies : pcre_deps + [thread_dep, librt] + libintl_deps + libiconv + platform_deps + [gnulib_libm_dependency, libm] + [libsysprof_capture_dep],
++  dependencies : pcre_deps + libgnutls_dep + [thread_dep, librt] + libintl_deps + libiconv + platform_deps + [gnulib_libm_dependency, libm] + [libsysprof_capture_dep],
    c_args : glib_c_args,
    objc_args : glib_c_args,
  )
 diff --git a/meson.build b/meson.build
-index e0b308a25..70dd5355e 100644
+index 0d892fb2d..091029fea 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -2056,6 +2056,13 @@ if host_system == 'linux'
+@@ -2078,6 +2078,13 @@ if host_system == 'linux'
    glib_conf.set('HAVE_LIBMOUNT', libmount_dep.found())
  endif
  
@@ -649,7 +649,7 @@ index e0b308a25..70dd5355e 100644
    winsock2 = cc.find_library('ws2_32')
  endif
 diff --git a/meson_options.txt b/meson_options.txt
-index af9645eda..2c4b2c37e 100644
+index 072765361..d2370042f 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
 @@ -34,6 +34,11 @@ option('libmount',
@@ -665,4 +665,5 @@ index af9645eda..2c4b2c37e 100644
         type : 'boolean',
         value : false,
 -- 
-2.28.0
+2.29.2
+

diff --git a/sources b/sources
index 36f6999..b258d8f 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (glib-2.67.1.tar.xz) = f7a576ab454633e6ad6ea00153a57f2f9d6bb20ec2c200fad43fe743192e3b912a7d4774e8c99594e3c53fa32853741c32a7df6c396226ea18c822e872c006dc
+SHA512 (glib-2.67.3.tar.xz) = 468b48ac96d3788e840783c5b7731955a3b9f3dbe6c4e387f246dd178a2c6cb8f24ef086545b7ec78a2a69523de707ce023a052fc9c5f3967b397a45618f5f77