From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Bastien Nocera To: git-commits@fedoraproject.org Subject: [rpms/glib2] cve-2026-58016-f44: Fix gspawn hangs in CI runners Date: Tue, 11 Aug 2026 10:37:38 GMT Message-ID: <178644465897.1.15751205553226012005.rpms-glib2-12966f03f498@fedoraproject.org> List-ID: X-Git-Repo: rpms/glib2 X-Git-Branch: cve-2026-58016-f44 X-Git-Rev: 12966f03f4988b5194db244917a03ba46f602668 QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvZ2xpYjIKQnJhbmNo IDogY3ZlLTIwMjYtNTgwMTYtZjQ0CkNvbW1pdCA6IDEyOTY2ZjAzZjQ5ODhiNTE5NGRiMjQ0OTE3 YTAzYmE0NmY2MDI2NjgKQXV0aG9yIDogQmFzdGllbiBOb2NlcmEgPGhhZGVzc0BoYWRlc3MubmV0 PgpEYXRlICAgOiAyMDIyLTAxLTI2VDE1OjI4OjU1KzAxOjAwClN0YXRzICA6ICsxNTUvLTAgaW4g MiBmaWxlKHMpClVSTCAgICA6IGh0dHBzOi8vc3JjLmZlZG9yYXByb2plY3Qub3JnL3JwbXMvZ2xp YjIvYy8xMjk2NmYwM2Y0OTg4YjUxOTRkYjI0NDkxN2EwM2JhNDZmNjAyNjY4P2JyYW5jaD1jdmUt MjAyNi01ODAxNi1mNDQKCkxvZzoKRml4IGdzcGF3biBoYW5ncyBpbiBDSSBydW5uZXJzCgotLS0K ZGlmZiAtLWdpdCBhLzAwMDEtZ3NwYXduLVJlcG9ydC1lcnJvcnMtd2l0aC1jbG9zaW5nLWZpbGUt ZGVzY3JpcHRvcnMtYi5wYXRjaCBiLzAwMDEtZ3NwYXduLVJlcG9ydC1lcnJvcnMtd2l0aC1jbG9z aW5nLWZpbGUtZGVzY3JpcHRvcnMtYi5wYXRjaApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAw MDAwMDAwLi4zOWFlNWFjCi0tLSAvZGV2L251bGwKKysrIGIvMDAwMS1nc3Bhd24tUmVwb3J0LWVy cm9ycy13aXRoLWNsb3NpbmctZmlsZS1kZXNjcmlwdG9ycy1iLnBhdGNoCkBAIC0wLDAgKzEsMTUy IEBACitGcm9tIGNlMDRhMTI0MDQwYmUwOTE0MDdlMDcwMjgwZDg2Y2E4MTBiYWNiOGMgTW9uIFNl cCAxNyAwMDowMDowMCAyMDAxCitGcm9tOiBQaGlsaXAgV2l0aG5hbGwgPHB3aXRobmFsbEBlbmRs ZXNzb3Mub3JnPgorRGF0ZTogTW9uLCAxNyBKYW4gMjAyMiAxNToyNzoyNCArMDAwMAorU3ViamVj dDogW1BBVENIXSBnc3Bhd246IFJlcG9ydCBlcnJvcnMgd2l0aCBjbG9zaW5nIGZpbGUgZGVzY3Jp cHRvcnMgYmV0d2VlbgorIGZvcmsvZXhlYworTUlNRS1WZXJzaW9uOiAxLjAKK0NvbnRlbnQtVHlw ZTogdGV4dC9wbGFpbjsgY2hhcnNldD1VVEYtOAorQ29udGVudC1UcmFuc2Zlci1FbmNvZGluZzog OGJpdAorCitJZiBhIHNlY2NvbXAgcG9saWN5IGlzIHNldCB1cCBpbmNvcnJlY3RseSBzbyB0aGF0 IGl0IHJldHVybnMgYEVQRVJNYCBmb3IKK2BjbG9zZV9yYW5nZSgpYCByYXRoZXIgdGhhbiBgRU5P U1lTYCBkdWUgdG8gaXQgbm90IGJlaW5nIHJlY29nbmlzZWQsIG5vCitlcnJvciB3b3VsZCBwcmV2 aW91c2x5IGJlIHJlcG9ydGVkIGZyb20gR0xpYiwgYnV0IHNvbWUgZmlsZSBkZXNjcmlwdG9ycwor d291bGRu4oCZdCBiZSBjbG9zZWQsIGFuZCB0aGF0IHdvdWxkIGNhdXNlIGEgaHVuZyB6b21iaWUg cHJvY2Vzcy4gVGhlCit6b21iaWUgcHJvY2VzcyB3b3VsZCBiZSB3YWl0aW5nIGZvciBvbmUgaGFs ZiBvZiBhIHNvY2tldCB0byBiZSBjbG9zZWQuCisKK0ZpeCB0aGF0IGJ5IGNvcnJlY3RseSBwcm9w YWdhdGluZyBlcnJvcnMgZnJvbSBgY2xvc2VfcmFuZ2UoKWAgYmFjayB0byB0aGUKK3BhcmVudCBw cm9jZXNzIHNvIHRoZXkgY2FuIGJlIHJlcG9ydGVkIGNvcnJlY3RseS4KKworRGlzdHJpYnV0aW9u cyB3aGljaCBhcmVu4oCZdCB5ZXQgY2FycnlpbmcgdGhlIERvY2tlciBmaXggdG8gY29ycmVjdGx5 CityZXR1cm4gYEVOT1NZU2AgZnJvbSB1bnJlY29nbmlzZWQgc3lzY2FsbHMgbWF5IHdhbnQgdG8g dGVtcG9yYXJpbHkgY2FycnkKK2FuIGFkZGl0aW9uYWwgcGF0Y2ggdG8gZmFsbCBiYWNrIHRvIGBz YWZlX2Zkd2FsaygpYCBpZiBgY2xvc2VfcmFuZ2UoKWAKK2ZhaWxzIHdpdGggYEVQRVJNYC4gVGhp cyBjaGFuZ2Ugd2lsbCBub3QgYmUgYWNjZXB0ZWQgdXBzdHJlYW0gYXMgYEVQRVJNYAoraXMgbm90 IHRoZSByaWdodCBlcnJvciBmb3IgYGNsb3NlX3JhbmdlKClgIHRvIGJlIHJldHVybmluZy4KKwor U2lnbmVkLW9mZi1ieTogUGhpbGlwIFdpdGhuYWxsIDxwd2l0aG5hbGxAZW5kbGVzc29zLm9yZz4K KworRml4ZXM6ICMyNTgwCistLS0KKyBnbGliL2dzcGF3bi5jIHwgNDQgKysrKysrKysrKysrKysr KysrKysrKysrKysrKysrKy0tLS0tLS0tLS0tLS0KKyAxIGZpbGUgY2hhbmdlZCwgMzEgaW5zZXJ0 aW9ucygrKSwgMTMgZGVsZXRpb25zKC0pCisKK2RpZmYgLS1naXQgYS9nbGliL2dzcGF3bi5jIGIv Z2xpYi9nc3Bhd24uYworaW5kZXggNjEzYzUzMWUzLi5kNDY0NGYxNjQgMTAwNjQ0CistLS0gYS9n bGliL2dzcGF3bi5jCisrKysgYi9nbGliL2dzcGF3bi5jCitAQCAtMTUyMCw3ICsxNTIwLDcgQEAg c2FmZV9mZHdhbGsgKGludCAoKmNiKSh2b2lkICpkYXRhLCBpbnQgZmQpLCB2b2lkICpkYXRhKQor IAorIC8qIFRoaXMgZnVuY3Rpb24gaXMgY2FsbGVkIGJldHdlZW4gZm9yaygpIGFuZCBleGVjKCkg YW5kIGhlbmNlIG11c3QgYmUKKyAgKiBhc3luYy1zaWduYWwtc2FmZSAoc2VlIHNpZ25hbC1zYWZl dHkoNykpLiAqLworLXN0YXRpYyB2b2lkCisrc3RhdGljIGludAorIHNhZmVfZmR3YWxrX3NldF9j bG9leGVjIChpbnQgbG93ZmQpCisgeworICNpZiBkZWZpbmVkKEhBVkVfQ0xPU0VfUkFOR0UpICYm IGRlZmluZWQoQ0xPU0VfUkFOR0VfQ0xPRVhFQykKK0BAIC0xNTM0LDE1ICsxNTM0LDE4IEBAIHNh ZmVfZmR3YWxrX3NldF9jbG9leGVjIChpbnQgbG93ZmQpCisgICAgKiBIYW5kbGUgRU5PU1lTIGlu IGNhc2UgaXTigJlzIHN1cHBvcnRlZCBpbiBsaWJjIGJ1dCBub3QgdGhlIGtlcm5lbDsgaWYgc28s CisgICAgKiBmYWxsIGJhY2sgdG8gc2FmZV9mZHdhbGsoKS4gSGFuZGxlIEVJTlZBTCBpbiBjYXNl IGBDTE9TRV9SQU5HRV9DTE9FWEVDYAorICAgICogaXMgbm90IHN1cHBvcnRlZC4gKi8KKy0gIGlm IChjbG9zZV9yYW5nZSAobG93ZmQsIEdfTUFYVUlOVCwgQ0xPU0VfUkFOR0VfQ0xPRVhFQykgIT0g MCAmJgorLSAgICAgIChlcnJubyA9PSBFTk9TWVMgfHwgZXJybm8gPT0gRUlOVkFMKSkKKysgIGlu dCByZXQgPSBjbG9zZV9yYW5nZSAobG93ZmQsIEdfTUFYVUlOVCwgQ0xPU0VfUkFOR0VfQ0xPRVhF Qyk7CisrICBpZiAocmV0ID09IDAgfHwgIShlcnJubyA9PSBFTk9TWVMgfHwgZXJybm8gPT0gRUlO VkFMKSkKKysgICAgcmV0dXJuIHJldDsKKyAjZW5kaWYgIC8qIEhBVkVfQ0xPU0VfUkFOR0UgKi8K Ky0gICh2b2lkKSBzYWZlX2Zkd2FsayAoc2V0X2Nsb2V4ZWMsIEdJTlRfVE9fUE9JTlRFUiAobG93 ZmQpKTsKKysgIHJldHVybiBzYWZlX2Zkd2FsayAoc2V0X2Nsb2V4ZWMsIEdJTlRfVE9fUE9JTlRF UiAobG93ZmQpKTsKKyB9CisgCisgLyogVGhpcyBmdW5jdGlvbiBpcyBjYWxsZWQgYmV0d2VlbiBm b3JrKCkgYW5kIGV4ZWMoKSBhbmQgaGVuY2UgbXVzdCBiZQorLSAqIGFzeW5jLXNpZ25hbC1zYWZl IChzZWUgc2lnbmFsLXNhZmV0eSg3KSkuICovCistc3RhdGljIHZvaWQKKysgKiBhc3luYy1zaWdu YWwtc2FmZSAoc2VlIHNpZ25hbC1zYWZldHkoNykpLgorKyAqCisrICogT24gZmFpbHVyZSwgYC0x YCB3aWxsIGJlIHJldHVybmVkIGFuZCBlcnJubyB3aWxsIGJlIHNldC4gKi8KKytzdGF0aWMgaW50 Cisgc2FmZV9jbG9zZWZyb20gKGludCBsb3dmZCkKKyB7CisgI2lmIGRlZmluZWQoX19GcmVlQlNE X18pIHx8IGRlZmluZWQoX19PcGVuQlNEX18pIHx8IFwKK0BAIC0xNTYwLDYgKzE1NjMsNyBAQCBz YWZlX2Nsb3NlZnJvbSAoaW50IGxvd2ZkKQorICAgICogT24gc3VjaCBzeXN0ZW1zLCBGX0NMT1NF RlJPTSBpcyBkZWZpbmVkLgorICAgICovCisgICAodm9pZCkgY2xvc2Vmcm9tIChsb3dmZCk7Cisr ICByZXR1cm4gMDsKKyAjZWxpZiBkZWZpbmVkKF9fRHJhZ29uRmx5X18pCisgICAvKiBJdCBpcyB1 bmNsZWFyIHdoZXRoZXIgY2xvc2Vmcm9tIGZ1bmN0aW9uIGluY2x1ZGVkIGluIERyYWdvbkZseUJT RCBsaWJjX3IKKyAgICAqIGlzIHNhZmUgdG8gdXNlIGJlY2F1c2UgaXQgY2FsbHMgYSBsb3Qgb2Yg bGlicmFyeSBmdW5jdGlvbnMuIEl0IGlzIGFsc28KK0BAIC0xNTY3LDEyICsxNTcxLDEzIEBAIHNh ZmVfY2xvc2Vmcm9tIChpbnQgbG93ZmQpCisgICAgKiBkaXJlY3Qgc3lzdGVtIGNhbGwgaGVyZSBv dXJzZWx2ZXMgdG8gYXZvaWQgcG9zc2libGUgaXNzdWVzLgorICAgICovCisgICAodm9pZCkgc3lz Y2FsbCAoU1lTX2Nsb3NlZnJvbSwgbG93ZmQpOworKyAgcmV0dXJuIDA7CisgI2VsaWYgZGVmaW5l ZChGX0NMT1NFTSkKKyAgIC8qIE5ldEJTRCBhbmQgQUlYIGhhdmUgYSBzcGVjaWFsIGZjbnRsIGNv bW1hbmQgd2hpY2ggZG9lcyB0aGUgc2FtZSB0aGluZyBhcworICAgICogY2xvc2Vmcm9tLiBOZXRC U0QgYWxzbyBpbmNsdWRlcyBjbG9zZWZyb20gZnVuY3Rpb24sIHdoaWNoIHNlZW1zIHRvIGJlIGEK KyAgICAqIHNpbXBsZSB3cmFwcGVyIG9mIHRoZSBmY250bCBjb21tYW5kLgorICAgICovCistICAo dm9pZCkgZmNudGwgKGxvd2ZkLCBGX0NMT1NFTSk7CisrICByZXR1cm4gZmNudGwgKGxvd2ZkLCBG X0NMT1NFTSk7CisgI2Vsc2UKKyAKKyAjaWYgZGVmaW5lZChIQVZFX0NMT1NFX1JBTkdFKQorQEAg LTE1ODIsOSArMTU4NywxMSBAQCBzYWZlX2Nsb3NlZnJvbSAoaW50IGxvd2ZkKQorICAgICoKKyAg ICAqIEhhbmRsZSBFTk9TWVMgaW4gY2FzZSBpdOKAmXMgc3VwcG9ydGVkIGluIGxpYmMgYnV0IG5v dCB0aGUga2VybmVsOyBpZiBzbywKKyAgICAqIGZhbGwgYmFjayB0byBzYWZlX2Zkd2FsaygpLiAq LworLSAgaWYgKGNsb3NlX3JhbmdlIChsb3dmZCwgR19NQVhVSU5ULCAwKSAhPSAwICYmIGVycm5v ID09IEVOT1NZUykKKysgIGludCByZXQgPSBjbG9zZV9yYW5nZSAobG93ZmQsIEdfTUFYVUlOVCwg MCk7CisrICBpZiAocmV0ID09IDAgfHwgZXJybm8gIT0gRU5PU1lTKQorKyAgICByZXR1cm4gcmV0 OworICNlbmRpZiAgLyogSEFWRV9DTE9TRV9SQU5HRSAqLworLSAgKHZvaWQpIHNhZmVfZmR3YWxr IChjbG9zZV9mdW5jLCBHSU5UX1RPX1BPSU5URVIgKGxvd2ZkKSk7CisrICByZXR1cm4gc2FmZV9m ZHdhbGsgKGNsb3NlX2Z1bmMsIEdJTlRfVE9fUE9JTlRFUiAobG93ZmQpKTsKKyAjZW5kaWYKKyB9 CisgCitAQCAtMTYyMiw3ICsxNjI5LDggQEAgZW51bQorICAgQ0hJTERfRVhFQ19GQUlMRUQsCisg ICBDSElMRF9PUEVOX0ZBSUxFRCwKKyAgIENISUxEX0RVUDJfRkFJTEVELAorLSAgQ0hJTERfRk9S S19GQUlMRUQKKysgIENISUxEX0ZPUktfRkFJTEVELAorKyAgQ0hJTERfQ0xPU0VfRkFJTEVELAor IH07CisgCisgLyogVGhpcyBmdW5jdGlvbiBpcyBjYWxsZWQgYmV0d2VlbiBmb3JrKCkgYW5kIGV4 ZWMoKSBhbmQgaGVuY2UgbXVzdCBiZQorQEAgLTE3MzgsMTIgKzE3NDYsMTQgQEAgZG9fZXhlYyAo Z2ludCAgICAgICAgICAgICAgICAgIGNoaWxkX2Vycl9yZXBvcnRfZmQsCisgICAgICAgICAgIGlm IChzYWZlX2R1cDIgKGNoaWxkX2Vycl9yZXBvcnRfZmQsIDMpIDwgMCkKKyAgICAgICAgICAgICB3 cml0ZV9lcnJfYW5kX2V4aXQgKGNoaWxkX2Vycl9yZXBvcnRfZmQsIENISUxEX0RVUDJfRkFJTEVE KTsKKyAgICAgICAgICAgc2V0X2Nsb2V4ZWMgKEdJTlRfVE9fUE9JTlRFUiAoMCksIDMpOworLSAg ICAgICAgICBzYWZlX2Nsb3NlZnJvbSAoNCk7CisrICAgICAgICAgIGlmIChzYWZlX2Nsb3NlZnJv bSAoNCkgPCAwKQorKyAgICAgICAgICAgIHdyaXRlX2Vycl9hbmRfZXhpdCAoY2hpbGRfZXJyX3Jl cG9ydF9mZCwgQ0hJTERfQ0xPU0VfRkFJTEVEKTsKKyAgICAgICAgICAgY2hpbGRfZXJyX3JlcG9y dF9mZCA9IDM7CisgICAgICAgICB9CisgICAgICAgZWxzZQorICAgICAgICAgeworLSAgICAgICAg ICBzYWZlX2Zkd2Fsa19zZXRfY2xvZXhlYyAoMyk7CisrICAgICAgICAgIGlmIChzYWZlX2Zkd2Fs a19zZXRfY2xvZXhlYyAoMykgPCAwKQorKyAgICAgICAgICAgIHdyaXRlX2Vycl9hbmRfZXhpdCAo Y2hpbGRfZXJyX3JlcG9ydF9mZCwgQ0hJTERfQ0xPU0VfRkFJTEVEKTsKKyAgICAgICAgIH0KKyAg ICAgfQorICAgZWxzZQorQEAgLTI1NDMsNyArMjU1MywxNSBAQCBmb3JrX2V4ZWMgKGdib29sZWFu ICAgICAgICAgICAgICBpbnRlcm1lZGlhdGVfY2hpbGQsCisgICAgICAgICAgICAgICAgICAgICAg ICAgICAgXygiRmFpbGVkIHRvIGZvcmsgY2hpbGQgcHJvY2VzcyAoJXMpIiksCisgICAgICAgICAg ICAgICAgICAgICAgICAgICAgZ19zdHJlcnJvciAoYnVmWzFdKSk7CisgICAgICAgICAgICAgICBi cmVhazsKKy0gICAgICAgICAgICAgIAorKworKyAgICAgICAgICAgIGNhc2UgQ0hJTERfQ0xPU0Vf RkFJTEVEOgorKyAgICAgICAgICAgICAgZ19zZXRfZXJyb3IgKGVycm9yLAorKyAgICAgICAgICAg ICAgICAgICAgICAgICAgIEdfU1BBV05fRVJST1IsCisrICAgICAgICAgICAgICAgICAgICAgICAg ICAgR19TUEFXTl9FUlJPUl9GQUlMRUQsCisrICAgICAgICAgICAgICAgICAgICAgICAgICAgXygi RmFpbGVkIHRvIGNsb3NlIGZpbGUgZGVzY3JpcHRvciBmb3IgY2hpbGQgcHJvY2VzcyAoJXMpIiks CisrICAgICAgICAgICAgICAgICAgICAgICAgICAgZ19zdHJlcnJvciAoYnVmWzFdKSk7CisrICAg ICAgICAgICAgICBicmVhazsKKysKKyAgICAgICAgICAgICBkZWZhdWx0OgorICAgICAgICAgICAg ICAgZ19zZXRfZXJyb3IgKGVycm9yLAorICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdfU1BB V05fRVJST1IsCistLSAKKzIuMzQuMQorCgpkaWZmIC0tZ2l0IGEvZ2xpYjIuc3BlYyBiL2dsaWIy LnNwZWMKaW5kZXggMzdjNDFlNS4uZjVhNGY3YSAxMDA2NDQKLS0tIGEvZ2xpYjIuc3BlYworKysg Yi9nbGliMi5zcGVjCkBAIC0xNyw2ICsxNyw5IEBAIFBhdGNoMDogZ251dGxzLWhtYWMucGF0Y2gK ICMgUHJvcG9zZWQgdXBzdHJlYW0gYXQgaHR0cHM6Ly9naXRsYWIuZ25vbWUub3JnL0dOT01FL2ds aWIvLS9tZXJnZV9yZXF1ZXN0cy8xNTk2CiBQYXRjaDE6IGdkZXNrdG9wYXBwaW5mby5wYXRjaAog CisjIGh0dHBzOi8vZ2l0bGFiLmdub21lLm9yZy9HTk9NRS9nbGliLy0vbWVyZ2VfcmVxdWVzdHMv MjQzNQorUGF0Y2gyOiAwMDAxLWdzcGF3bi1SZXBvcnQtZXJyb3JzLXdpdGgtY2xvc2luZy1maWxl LWRlc2NyaXB0b3JzLWIucGF0Y2gKKwogQnVpbGRSZXF1aXJlczogY2hycGF0aAogQnVpbGRSZXF1 aXJlczogZ2NjCiBCdWlsZFJlcXVpcmVzOiBnY2MtYysrCg==