From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Zephyr Lykos To: git-commits@fedoraproject.org Subject: [rpms/glib2] cve-2026-58016-f44: gthreadedresolver: Fix race between source callbacks and finalize (fedora#2235890) Date: Tue, 11 Aug 2026 10:38:04 GMT Message-ID: <178644468413.1.15058403165576494062.rpms-glib2-2eebf802dd2b@fedoraproject.org> List-ID: X-Git-Repo: rpms/glib2 X-Git-Branch: cve-2026-58016-f44 X-Git-Rev: 2eebf802dd2bd192e30d2acca9779821d35da967 QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvZ2xpYjIKQnJhbmNo IDogY3ZlLTIwMjYtNTgwMTYtZjQ0CkNvbW1pdCA6IDJlZWJmODAyZGQyYmQxOTJlMzBkMmFjY2E5 Nzc5ODIxZDM1ZGE5NjcKQXV0aG9yIDogWmVwaHlyIEx5a29zIDxnaXRAbW9jaGFhLndzPgpEYXRl ICAgOiAyMDIzLTA5LTI3VDE2OjMxOjU1KzA4OjAwClN0YXRzICA6ICsxMzYvLTAgaW4gMiBmaWxl KHMpClVSTCAgICA6IGh0dHBzOi8vc3JjLmZlZG9yYXByb2plY3Qub3JnL3JwbXMvZ2xpYjIvYy8y ZWViZjgwMmRkMmJkMTkyZTMwZDJhY2NhOTc3OTgyMWQzNWRhOTY3P2JyYW5jaD1jdmUtMjAyNi01 ODAxNi1mNDQKCkxvZzoKZ3RocmVhZGVkcmVzb2x2ZXI6IEZpeCByYWNlIGJldHdlZW4gc291cmNl IGNhbGxiYWNrcyBhbmQgZmluYWxpemUgKGZlZG9yYSMyMjM1ODkwKQoKLS0tCmRpZmYgLS1naXQg YS9nbGliMi5zcGVjIGIvZ2xpYjIuc3BlYwppbmRleCAwMjRiNTEzLi41MGMyNWM2IDEwMDY0NAot LS0gYS9nbGliMi5zcGVjCisrKyBiL2dsaWIyLnNwZWMKQEAgLTE2LDYgKzE2LDEwIEBAIFBhdGNo OiAgICAgICAgICBnbnV0bHMtaG1hYy5wYXRjaAogIyB0aGUgYmFyZW1ldGFsIERvY2tlciBpcyB1 cGRhdGVkIHRoZXJlIGkuZS4gbGV0cyBiZSBhIGxpdHRsZSBiaXQgcHJhZ21hdGljLi4uCiBQYXRj aDogICAgICAgICAgZ3NwYXduLWVwZXJtLnBhdGNoCiAKKyMgaHR0cHM6Ly9naXRsYWIuZ25vbWUu b3JnL0dOT01FL2dsaWIvLS9tZXJnZV9yZXF1ZXN0cy8zNTc1CisjIG5vdCByZWxlYXNlZCB5ZXQK K1BhdGNoOiAgICAgICAgICBndGhyZWFkZWRyZXNvbHZlci1yYWNlLnBhdGNoCisKIEJ1aWxkUmVx dWlyZXM6ICBnY2MKIEJ1aWxkUmVxdWlyZXM6ICBnY2MtYysrCiBCdWlsZFJlcXVpcmVzOiAgZ2V0 dGV4dAoKZGlmZiAtLWdpdCBhL2d0aHJlYWRlZHJlc29sdmVyLXJhY2UucGF0Y2ggYi9ndGhyZWFk ZWRyZXNvbHZlci1yYWNlLnBhdGNoCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAu LjkxMWI3OGMKLS0tIC9kZXYvbnVsbAorKysgYi9ndGhyZWFkZWRyZXNvbHZlci1yYWNlLnBhdGNo CkBAIC0wLDAgKzEsMTMyIEBACitGcm9tIDgyYzc2NGNlMmU0MmYwZDEwMzI2MjdkYWJjYmQ3NDJk NWYyYmQ4ZmEgTW9uIFNlcCAxNyAwMDowMDowMCAyMDAxCitGcm9tOiBQaGlsaXAgV2l0aG5hbGwg PHBoaWxpcEB0ZWNub2NvZGUuY28udWs+CitEYXRlOiBNb24sIDExIFNlcCAyMDIzIDE2OjAyOjE1 ICswMTAwCitTdWJqZWN0OiBbUEFUQ0hdIGd0aHJlYWRlZHJlc29sdmVyOiBGaXggcmFjZSBiZXR3 ZWVuIHNvdXJjZSBjYWxsYmFja3MgYW5kCisgZmluYWxpemUKK01JTUUtVmVyc2lvbjogMS4wCitD b250ZW50LVR5cGU6IHRleHQvcGxhaW47IGNoYXJzZXQ9VVRGLTgKK0NvbnRlbnQtVHJhbnNmZXIt RW5jb2Rpbmc6IDhiaXQKKworSSBoYWQgdGhvdWdodCB0aGF0IGJlY2F1c2UgYGdfc291cmNlX2Rl c3Ryb3koKWAgd2FzIGNhbGxlZCBmb3IgdGhlIHR3bworc291cmNlcyAoY2FuY2VsIGFuZCB0aW1l b3V0KSBpbiB0aGUgYEdUYXNrYCBmaW5hbGl6ZSBmdW5jdGlvbiBmb3IgYQordGhyZWFkZWQgcmVz b2x2ZXIgb3BlcmF0aW9uLCB0aGF0IGl0IHdvdWxkIGJlIGZpbmUgdG8gdXNlIGEgcGxhaW4KK3Bv aW50ZXIgaW4gdGhlIHNvdXJjZSBjYWxsYmFja3MgdG8gcG9pbnQgdG8gdGhlIGBHVGFza2AuCisK K1RoYXQgdHVybnMgb3V0IHRvIG5vdCBiZSB0cnVlOiBiZWNhdXNlIHRoZSBzb3VyY2UgY2FsbGJh Y2tzIGFyZSBleGVjdXRlZAoraW4gdGhlIEdMaWIgd29ya2VyIHRocmVhZCwgYW5kIHRoZSBgR1Rh c2tgIGNhbiBiZSBmaW5hbGl6ZWQgaW4gYW5vdGhlcgordGhyZWFkLCBpdOKAmXMgcG9zc2libGUg Zm9yIGEgc291cmNlIGNhbGxiYWNrIChlLmcuIGBjYW5jZWxsZWRfY2IoKWApIHRvCitiZSBzY2hl ZHVsZWQgaW4gdGhlIHdvcmtlciB0aHJlYWQsIHRoZW4gZm9yIHRoZSBgR1Rhc2tgIHRvIGJlIGZp bmFsaXplZCwKK2FuZCB0aGVuIHRoZSBzb3VyY2UgY2FsbGJhY2sgdG8gY29udGludWUgZXhlY3V0 aW9uIGFuZCBmaW5kIGl0c2VsZgorZG9pbmcgYSB1c2UtYWZ0ZXItZnJlZS4KKworRml4IHRoYXQg YnkgdXNpbmcgYSB3ZWFrIHJlZiB0byB0aGUgYEdUYXNrYCBpbiB0aGUgc291cmNlIGNhbGxiYWNr cywKK3JhdGhlciB0aGFuIGEgcGxhaW4gcG9pbnRlci4KKworU2lnbmVkLW9mZi1ieTogUGhpbGlw IFdpdGhuYWxsIDxwaGlsaXBAdGVjbm9jb2RlLmNvLnVrPgorCitGaXhlczogIzMxMDUKKy0tLQor IGdpby9ndGhyZWFkZWRyZXNvbHZlci5jIHwgNDMgKysrKysrKysrKysrKysrKysrKysrKysrKysr KysrKysrKystLS0tLS0KKyAxIGZpbGUgY2hhbmdlZCwgMzcgaW5zZXJ0aW9ucygrKSwgNiBkZWxl dGlvbnMoLSkKKworZGlmZiAtLWdpdCBhL2dpby9ndGhyZWFkZWRyZXNvbHZlci5jIGIvZ2lvL2d0 aHJlYWRlZHJlc29sdmVyLmMKK2luZGV4IDJkOTQ1MzFiZmQuLmM3YTU2NzU0OWYgMTAwNjQ0Cist LS0gYS9naW8vZ3RocmVhZGVkcmVzb2x2ZXIuYworKysrIGIvZ2lvL2d0aHJlYWRlZHJlc29sdmVy LmMKK0BAIC0xNDIyLDEwICsxNDIyLDE3IEBAIGxvb2t1cF9yZWNvcmRzX2ZpbmlzaCAoR1Jlc29s dmVyICAgICAqcmVzb2x2ZXIsCisgc3RhdGljIGdib29sZWFuCisgdGltZW91dF9jYiAoZ3BvaW50 ZXIgdXNlcl9kYXRhKQorIHsKKy0gIEdUYXNrICp0YXNrID0gR19UQVNLICh1c2VyX2RhdGEpOwor LSAgTG9va3VwRGF0YSAqZGF0YSA9IGdfdGFza19nZXRfdGFza19kYXRhICh0YXNrKTsKKysgIEdX ZWFrUmVmICp3ZWFrX3Rhc2sgPSB1c2VyX2RhdGE7CisrICBHVGFzayAqdGFzayA9IE5VTEw7ICAv KiAob3duZWQpICovCisrICBMb29rdXBEYXRhICpkYXRhOworICAgZ2Jvb2xlYW4gc2hvdWxkX3Jl dHVybjsKKyAKKysgIHRhc2sgPSBnX3dlYWtfcmVmX2dldCAod2Vha190YXNrKTsKKysgIGlmICh0 YXNrID09IE5VTEwpCisrICAgIHJldHVybiBHX1NPVVJDRV9SRU1PVkU7CisrCisrICBkYXRhID0g Z190YXNrX2dldF90YXNrX2RhdGEgKHRhc2spOworKworICAgZ19tdXRleF9sb2NrICgmZGF0YS0+ bG9jayk7CisgCisgICBzaG91bGRfcmV0dXJuID0gZ19hdG9taWNfaW50X2NvbXBhcmVfYW5kX2V4 Y2hhbmdlICgmZGF0YS0+d2lsbF9yZXR1cm4sIE5PVF9ZRVQsIFRJTUVEX09VVCk7CitAQCAtMTQ0 Myw2ICsxNDUwLDggQEAgdGltZW91dF9jYiAoZ3BvaW50ZXIgdXNlcl9kYXRhKQorICAgZ19jb25k X2Jyb2FkY2FzdCAoJmRhdGEtPmNvbmQpOworICAgZ19tdXRleF91bmxvY2sgKCZkYXRhLT5sb2Nr KTsKKyAKKysgIGdfb2JqZWN0X3VucmVmICh0YXNrKTsKKysKKyAgIHJldHVybiBHX1NPVVJDRV9S RU1PVkU7CisgfQorIAorQEAgLTE0NTIsMTAgKzE0NjEsMTcgQEAgc3RhdGljIGdib29sZWFuCisg Y2FuY2VsbGVkX2NiIChHQ2FuY2VsbGFibGUgKmNhbmNlbGxhYmxlLAorICAgICAgICAgICAgICAg Z3BvaW50ZXIgICAgICB1c2VyX2RhdGEpCisgeworLSAgR1Rhc2sgKnRhc2sgPSBHX1RBU0sgKHVz ZXJfZGF0YSk7CistICBMb29rdXBEYXRhICpkYXRhID0gZ190YXNrX2dldF90YXNrX2RhdGEgKHRh c2spOworKyAgR1dlYWtSZWYgKndlYWtfdGFzayA9IHVzZXJfZGF0YTsKKysgIEdUYXNrICp0YXNr ID0gTlVMTDsgIC8qIChvd25lZCkgKi8KKysgIExvb2t1cERhdGEgKmRhdGE7CisgICBnYm9vbGVh biBzaG91bGRfcmV0dXJuOworIAorKyAgdGFzayA9IGdfd2Vha19yZWZfZ2V0ICh3ZWFrX3Rhc2sp OworKyAgaWYgKHRhc2sgPT0gTlVMTCkKKysgICAgcmV0dXJuIEdfU09VUkNFX1JFTU9WRTsKKysK KysgIGRhdGEgPSBnX3Rhc2tfZ2V0X3Rhc2tfZGF0YSAodGFzayk7CisrCisgICBnX211dGV4X2xv Y2sgKCZkYXRhLT5sb2NrKTsKKyAKKyAgIGdfYXNzZXJ0IChnX2NhbmNlbGxhYmxlX2lzX2NhbmNl bGxlZCAoY2FuY2VsbGFibGUpKTsKK0BAIC0xNDczLDkgKzE0ODksMTggQEAgY2FuY2VsbGVkX2Ni IChHQ2FuY2VsbGFibGUgKmNhbmNlbGxhYmxlLAorICAgZ19jb25kX2Jyb2FkY2FzdCAoJmRhdGEt PmNvbmQpOworICAgZ19tdXRleF91bmxvY2sgKCZkYXRhLT5sb2NrKTsKKyAKKysgIGdfb2JqZWN0 X3VucmVmICh0YXNrKTsKKysKKyAgIHJldHVybiBHX1NPVVJDRV9SRU1PVkU7CisgfQorIAorK3N0 YXRpYyB2b2lkCisrd2Vha19yZWZfY2xlYXJfYW5kX2ZyZWUgKEdXZWFrUmVmICp3ZWFrX3JlZikK Kyt7CisrICBnX3dlYWtfcmVmX2NsZWFyICh3ZWFrX3JlZik7CisrICBnX2ZyZWUgKHdlYWtfcmVm KTsKKyt9CisrCisgc3RhdGljIHZvaWQKKyBydW5fdGFza19pbl90aHJlYWRfcG9vbF9hc3luYyAo R1RocmVhZGVkUmVzb2x2ZXIgKnNlbGYsCisgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IEdUYXNrICAgICAgICAgICAgICp0YXNrKQorQEAgLTE0OTAsMTcgKzE1MTUsMjMgQEAgcnVuX3Rh c2tfaW5fdGhyZWFkX3Bvb2xfYXN5bmMgKEdUaHJlYWRlZFJlc29sdmVyICpzZWxmLAorIAorICAg aWYgKHRpbWVvdXRfbXMgIT0gMCkKKyAgICAgeworKyAgICAgIEdXZWFrUmVmICp3ZWFrX3Rhc2sg PSBnX25ldzAgKEdXZWFrUmVmLCAxKTsKKysgICAgICBnX3dlYWtfcmVmX3NldCAod2Vha190YXNr LCB0YXNrKTsKKysKKyAgICAgICBkYXRhLT50aW1lb3V0X3NvdXJjZSA9IGdfdGltZW91dF9zb3Vy Y2VfbmV3ICh0aW1lb3V0X21zKTsKKyAgICAgICBnX3NvdXJjZV9zZXRfc3RhdGljX25hbWUgKGRh dGEtPnRpbWVvdXRfc291cmNlLCAiW2dpb10gdGhyZWFkZWQgcmVzb2x2ZXIgdGltZW91dCIpOwor LSAgICAgIGdfc291cmNlX3NldF9jYWxsYmFjayAoZGF0YS0+dGltZW91dF9zb3VyY2UsIEdfU09V UkNFX0ZVTkMgKHRpbWVvdXRfY2IpLCB0YXNrLCBOVUxMKTsKKysgICAgICBnX3NvdXJjZV9zZXRf Y2FsbGJhY2sgKGRhdGEtPnRpbWVvdXRfc291cmNlLCBHX1NPVVJDRV9GVU5DICh0aW1lb3V0X2Ni KSwgZ19zdGVhbF9wb2ludGVyICgmd2Vha190YXNrKSwgKEdEZXN0cm95Tm90aWZ5KSB3ZWFrX3Jl Zl9jbGVhcl9hbmRfZnJlZSk7CisgICAgICAgZ19zb3VyY2VfYXR0YWNoIChkYXRhLT50aW1lb3V0 X3NvdXJjZSwgR0xJQl9QUklWQVRFX0NBTEwgKGdfZ2V0X3dvcmtlcl9jb250ZXh0KSAoKSk7Cisg ICAgIH0KKyAKKyAgIGlmIChjYW5jZWxsYWJsZSAhPSBOVUxMKQorICAgICB7CisrICAgICAgR1dl YWtSZWYgKndlYWtfdGFzayA9IGdfbmV3MCAoR1dlYWtSZWYsIDEpOworKyAgICAgIGdfd2Vha19y ZWZfc2V0ICh3ZWFrX3Rhc2ssIHRhc2spOworKworICAgICAgIGRhdGEtPmNhbmNlbGxhYmxlX3Nv dXJjZSA9IGdfY2FuY2VsbGFibGVfc291cmNlX25ldyAoY2FuY2VsbGFibGUpOworICAgICAgIGdf c291cmNlX3NldF9zdGF0aWNfbmFtZSAoZGF0YS0+Y2FuY2VsbGFibGVfc291cmNlLCAiW2dpb10g dGhyZWFkZWQgcmVzb2x2ZXIgY2FuY2VsbGFibGUiKTsKKy0gICAgICBnX3NvdXJjZV9zZXRfY2Fs bGJhY2sgKGRhdGEtPmNhbmNlbGxhYmxlX3NvdXJjZSwgR19TT1VSQ0VfRlVOQyAoY2FuY2VsbGVk X2NiKSwgdGFzaywgTlVMTCk7CisrICAgICAgZ19zb3VyY2Vfc2V0X2NhbGxiYWNrIChkYXRhLT5j YW5jZWxsYWJsZV9zb3VyY2UsIEdfU09VUkNFX0ZVTkMgKGNhbmNlbGxlZF9jYiksIGdfc3RlYWxf cG9pbnRlciAoJndlYWtfdGFzayksIChHRGVzdHJveU5vdGlmeSkgd2Vha19yZWZfY2xlYXJfYW5k X2ZyZWUpOworICAgICAgIGdfc291cmNlX2F0dGFjaCAoZGF0YS0+Y2FuY2VsbGFibGVfc291cmNl LCBHTElCX1BSSVZBVEVfQ0FMTCAoZ19nZXRfd29ya2VyX2NvbnRleHQpICgpKTsKKyAgICAgfQor IAorLS0gCitHaXRMYWIKKwo=