From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Adam Williamson To: git-commits@fedoraproject.org Subject: [rpms/glib2] cve-2026-58016-f44: Backport PR #2784 to fix `weak_locations != NULL` crashes Date: Tue, 11 Aug 2026 10:37:42 GMT Message-ID: <178644466268.1.11068179747379810909.rpms-glib2-5cfc8d9d4fe3@fedoraproject.org> List-ID: X-Git-Repo: rpms/glib2 X-Git-Branch: cve-2026-58016-f44 X-Git-Rev: 5cfc8d9d4fe3abf46d103c85d9b6e2fc457b671e QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvZ2xpYjIKQnJhbmNo IDogY3ZlLTIwMjYtNTgwMTYtZjQ0CkNvbW1pdCA6IDVjZmM4ZDlkNGZlM2FiZjQ2ZDEwM2M4NWQ5 YjZlMmZjNDU3YjY3MWUKQXV0aG9yIDogQWRhbSBXaWxsaWFtc29uIDxhd2lsbGlhbUByZWRoYXQu Y29tPgpEYXRlICAgOiAyMDIyLTA2LTI4VDE2OjU0OjExLTA3OjAwClN0YXRzICA6ICs2OC8tMCBp biAyIGZpbGUocykKVVJMICAgIDogaHR0cHM6Ly9zcmMuZmVkb3JhcHJvamVjdC5vcmcvcnBtcy9n bGliMi9jLzVjZmM4ZDlkNGZlM2FiZjQ2ZDEwM2M4NWQ5YjZlMmZjNDU3YjY3MWU/YnJhbmNoPWN2 ZS0yMDI2LTU4MDE2LWY0NAoKTG9nOgpCYWNrcG9ydCBQUiAjMjc4NCB0byBmaXggYHdlYWtfbG9j YXRpb25zICE9IE5VTExgIGNyYXNoZXMKCi0tLQpkaWZmIC0tZ2l0IGEvMjc4NC5wYXRjaCBiLzI3 ODQucGF0Y2gKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uMDkzY2ZkOQotLS0g L2Rldi9udWxsCisrKyBiLzI3ODQucGF0Y2gKQEAgLTAsMCArMSw2MyBAQAorRnJvbSBkNDA0M2Vj ZWQ1YzdmMjFiMWE0OTQyYjMwNWY5ZGVkMTI3Y2JkYjgzIE1vbiBTZXAgMTcgMDA6MDA6MDAgMjAw MQorRnJvbTogU2ltb24gTWNWaXR0aWUgPHNtY3ZAZGViaWFuLm9yZz4KK0RhdGU6IFN1biwgMjYg SnVuIDIwMjIgMTI6MDQ6MzIgKzAxMDAKK1N1YmplY3Q6IFtQQVRDSF0gUmV2ZXJ0ICJnb2JqZWN0 OiBVc2UgZ19kYXRhbGlzdF9pZF9yZW1vdmVfbXVsdGlwbGUiCisKK1RoaXMgcmV2ZXJ0cyBjb21t aXQgZmE4YzdjMCAiZ29iamVjdDogVXNlIGdfZGF0YWxpc3RfaWRfcmVtb3ZlX211bHRpcGxlIgor KG9yIG1vcmUgc3BlY2lmaWNhbGx5IHRoZSBwYXJ0cyBvZiBpdCB0aGF0IHdlcmUgbm90IGFscmVh ZHkgcmV2ZXJ0ZWQKK2luIDAxYWMxZDkgImdvYmplY3Q6IEZpeCBjcmFzaCB3aGVuIGRpc3Bvc2lu ZyBhIEd0a0FjY2VsR3JvdXAiLgorCitXb3JrYXJvdW5kIGZvciBodHRwczovL2dpdGxhYi5nbm9t ZS5vcmcvR05PTUUvZ2xpYi8tL2lzc3Vlcy8yNjc2CisKK0J1ZzogaHR0cHM6Ly9naXRsYWIuZ25v bWUub3JnL0dOT01FL2dsaWIvLS9pc3N1ZXMvMjY3NgorLS0tCisgZ29iamVjdC9nb2JqZWN0LmMg fCAyNCArKysrKystLS0tLS0tLS0tLS0tLS0tLS0KKyAxIGZpbGUgY2hhbmdlZCwgNiBpbnNlcnRp b25zKCspLCAxOCBkZWxldGlvbnMoLSkKKworZGlmZiAtLWdpdCBhL2dvYmplY3QvZ29iamVjdC5j IGIvZ29iamVjdC9nb2JqZWN0LmMKK2luZGV4IDViYThmZDAxN2IuLjFjNmJmZWRmYWUgMTAwNjQ0 CistLS0gYS9nb2JqZWN0L2dvYmplY3QuYworKysrIGIvZ29iamVjdC9nb2JqZWN0LmMKK0BAIC0x MzUzLDE3ICsxMzUzLDEwIEBAIGdfb2JqZWN0X2RvX2dldF9wcm9wZXJ0eSAoR09iamVjdCAgICAg Km9iamVjdCwKKyBzdGF0aWMgdm9pZAorIGdfb2JqZWN0X3JlYWxfZGlzcG9zZSAoR09iamVjdCAq b2JqZWN0KQorIHsKKy0gIEdRdWFyayBrZXlzWzNdID0geworLSAgICBxdWFya19jbG9zdXJlX2Fy cmF5LAorLSAgICBxdWFya193ZWFrX3JlZnMsCistICAgIHF1YXJrX3dlYWtfbG9jYXRpb25zLAor LSAgfTsKKy0KKyAgIGdfc2lnbmFsX2hhbmRsZXJzX2Rlc3Ryb3kgKG9iamVjdCk7CistICAvKiBG SVhNRTogVGhpcyBzaG91bGQgYmUgc2ltcGxpZmllZCBkb3duIHRvIGEgc2luZ2xlIHJlbW92ZV9t dWx0aXBsZSgpIGNhbGwuCistICAgKiBTZWUgaHR0cHM6Ly9naXRsYWIuZ25vbWUub3JnL0dOT01F L2dsaWIvLS9pc3N1ZXMvMjY3MiAqLworLSAgZ19kYXRhbGlzdF9pZF9yZW1vdmVfbXVsdGlwbGUg KCZvYmplY3QtPnFkYXRhLCBrZXlzLCAxKTsKKy0gIGdfZGF0YWxpc3RfaWRfcmVtb3ZlX211bHRp cGxlICgmb2JqZWN0LT5xZGF0YSwga2V5cyArIDEsIDIpOworKyAgZ19kYXRhbGlzdF9pZF9zZXRf ZGF0YSAoJm9iamVjdC0+cWRhdGEsIHF1YXJrX2Nsb3N1cmVfYXJyYXksIE5VTEwpOworKyAgZ19k YXRhbGlzdF9pZF9zZXRfZGF0YSAoJm9iamVjdC0+cWRhdGEsIHF1YXJrX3dlYWtfcmVmcywgTlVM TCk7CisrICBnX2RhdGFsaXN0X2lkX3NldF9kYXRhICgmb2JqZWN0LT5xZGF0YSwgcXVhcmtfd2Vh a19sb2NhdGlvbnMsIE5VTEwpOworIH0KKyAKKyAjaWZkZWYgR19FTkFCTEVfREVCVUcKK0BAIC0z ODg4LDE1ICszODgxLDEwIEBAIGdfb2JqZWN0X3VucmVmIChncG9pbnRlciBfb2JqZWN0KQorIAl9 CisgCisgICAgICAgLyogd2UgYXJlIHN0aWxsIGluIHRoZSBwcm9jZXNzIG9mIHRha2luZyBhd2F5 IHRoZSBsYXN0IHJlZiAqLworKyAgICAgIGdfZGF0YWxpc3RfaWRfc2V0X2RhdGEgKCZvYmplY3Qt PnFkYXRhLCBxdWFya19jbG9zdXJlX2FycmF5LCBOVUxMKTsKKyAgICAgICBnX3NpZ25hbF9oYW5k bGVyc19kZXN0cm95IChvYmplY3QpOworLSAgICAgIHsKKy0gICAgICAgIEdRdWFyayBrZXlzWzNd ID0geworLSAgICAgICAgICBxdWFya19jbG9zdXJlX2FycmF5LAorLSAgICAgICAgICBxdWFya193 ZWFrX3JlZnMsCistICAgICAgICAgIHF1YXJrX3dlYWtfbG9jYXRpb25zLAorLSAgICAgICAgfTsK Ky0gICAgICAgIGdfZGF0YWxpc3RfaWRfcmVtb3ZlX211bHRpcGxlICgmb2JqZWN0LT5xZGF0YSwg a2V5cywgR19OX0VMRU1FTlRTIChrZXlzKSk7CistICAgICAgfQorKyAgICAgIGdfZGF0YWxpc3Rf aWRfc2V0X2RhdGEgKCZvYmplY3QtPnFkYXRhLCBxdWFya193ZWFrX3JlZnMsIE5VTEwpOworKyAg ICAgIGdfZGF0YWxpc3RfaWRfc2V0X2RhdGEgKCZvYmplY3QtPnFkYXRhLCBxdWFya193ZWFrX2xv Y2F0aW9ucywgTlVMTCk7CisgCisgICAgICAgLyogZGVjcmVtZW50IHRoZSBsYXN0IHJlZmVyZW5j ZSAqLworICAgICAgIG9sZF9yZWYgPSBnX2F0b21pY19pbnRfYWRkICgmb2JqZWN0LT5yZWZfY291 bnQsIC0xKTsKKy0tIAorR2l0TGFiCisKCmRpZmYgLS1naXQgYS9nbGliMi5zcGVjIGIvZ2xpYjIu c3BlYwppbmRleCAzOWZhNjI4Li45Yzc1NjAyIDEwMDY0NAotLS0gYS9nbGliMi5zcGVjCisrKyBi L2dsaWIyLnNwZWMKQEAgLTE3LDYgKzE3LDExIEBAIFBhdGNoMDogZ251dGxzLWhtYWMucGF0Y2gK ICMgUHJvcG9zZWQgdXBzdHJlYW0gYXQgaHR0cHM6Ly9naXRsYWIuZ25vbWUub3JnL0dOT01FL2ds aWIvLS9tZXJnZV9yZXF1ZXN0cy8xNTk2CiBQYXRjaDE6IGdkZXNrdG9wYXBwaW5mby5wYXRjaAog CisjIFJldmVydCBwYXJ0cyBvZiBhIGNvbW1pdCB0byBhdm9pZCAid2Vha19sb2NhdGlvbnMgIT0g TlVMTCIgY3Jhc2hlczoKKyMgaHR0cHM6Ly9naXRsYWIuZ25vbWUub3JnL0dOT01FL2dsaWIvLS9p c3N1ZXMvMjY3NgorIyBodHRwczovL2dpdGxhYi5nbm9tZS5vcmcvR05PTUUvZ2xpYi8tL21lcmdl X3JlcXVlc3RzLzI3ODQKK1BhdGNoMjogMjc4NC5wYXRjaAorCiBCdWlsZFJlcXVpcmVzOiBnY2MK IEJ1aWxkUmVxdWlyZXM6IGdjYy1jKysKIEJ1aWxkUmVxdWlyZXM6IGdldHRleHQK