From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Kalev Lember To: git-commits@fedoraproject.org Subject: [rpms/glib2] cve-2026-58016-f44: Backport a patch to avoid loading mismatching GIRepository versions Date: Tue, 11 Aug 2026 10:38:07 GMT Message-ID: <178644468738.1.13078442291192954867.rpms-glib2-87ea2bb208c6@fedoraproject.org> List-ID: X-Git-Repo: rpms/glib2 X-Git-Branch: cve-2026-58016-f44 X-Git-Rev: 87ea2bb208c6febfaef6f6c3ef880e0f3186066f QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvZ2xpYjIKQnJhbmNo IDogY3ZlLTIwMjYtNTgwMTYtZjQ0CkNvbW1pdCA6IDg3ZWEyYmIyMDhjNmZlYmZhZWY2ZjZjM2Vm ODgwZTBmMzE4NjA2NmYKQXV0aG9yIDogS2FsZXYgTGVtYmVyIDxrbGVtYmVyQHJlZGhhdC5jb20+ CkRhdGUgICA6IDIwMjQtMDEtMTFUMTQ6MTc6MjYrMDE6MDAKU3RhdHMgIDogKzkxLy0wIGluIDIg ZmlsZShzKQpVUkwgICAgOiBodHRwczovL3NyYy5mZWRvcmFwcm9qZWN0Lm9yZy9ycG1zL2dsaWIy L2MvODdlYTJiYjIwOGM2ZmViZmFlZjZmNmMzZWY4ODBlMGYzMTg2MDY2Zj9icmFuY2g9Y3ZlLTIw MjYtNTgwMTYtZjQ0CgpMb2c6CkJhY2twb3J0IGEgcGF0Y2ggdG8gYXZvaWQgbG9hZGluZyBtaXNt YXRjaGluZyBHSVJlcG9zaXRvcnkgdmVyc2lvbnMKCi0tLQpkaWZmIC0tZ2l0IGEvMzc5NS5wYXRj aCBiLzM3OTUucGF0Y2gKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uYzY4Y2Y4 NAotLS0gL2Rldi9udWxsCisrKyBiLzM3OTUucGF0Y2gKQEAgLTAsMCArMSw4NyBAQAorRnJvbSBl NmM4Yzc1Y2NjNmMxOWY4N2I1M2JmZTJkYWJlOGJhODk1YjAzMTFhIE1vbiBTZXAgMTcgMDA6MDA6 MDAgMjAwMQorRnJvbTogU2ltb24gTWNWaXR0aWUgPHNtY3ZAZGViaWFuLm9yZz4KK0RhdGU6IEZy aSwgMjkgRGVjIDIwMjMgMTQ6MTA6MjIgKzAwMDAKK1N1YmplY3Q6IFtQQVRDSF0gZ2lyZXBvc2l0 b3J5OiBTa2lwIEdJUmVwb3NpdG9yeSB2ZXJzaW9ucyBub3QgbWF0Y2hpbmcKKyBHSVJlcG9zaXRv cnktMy4wCisKK0EgZmV3IGFwcGxpY2F0aW9ucyBzdWNoIGFzIGdub21lLW11c2ljIGxvYWQgdGhl IEdJUmVwb3NpdG9yeSB0eXBlbGliCithbmQgdXNlIGl0IHRvIGFkanVzdCB0aGVpciBzZWFyY2gg cGF0aHMuCisKK0dMaWIgMi43OS54IG5vdyBwcm92aWRlcyBsaWJnaXJlcG9zaXRvcnktMi4wLnNv LjAgKEdJUmVwb3NpdG9yeS0zLjApLAorYnV0IGVhY2ggT1MgZGlzdHJpYnV0aW9uIGlzIGxpa2Vs eSB0byBoYXZlIGEgdHJhbnNpdGlvbmFsIHBlcmlvZCBkdXJpbmcKK3doaWNoIEdMaWIncyBsaWJn aXJlcG9zaXRvcnktMi4wLnNvLjAgaGFzIGJlY29tZSBhdmFpbGFibGUsIGJ1dCBiaW5kaW5ncwor bGlrZSBQeUdJIGFuZCBnanMgYXJlIHN0aWxsIGxpbmtlZCB0byBnb2JqZWN0LWludHJvc3BlY3Rp b24ncworbGliZ2lyZXBvc2l0b3J5LTEuMC5zby4xIChHSVJlcG9zaXRvcnktMi4wKS4KKworRHVy aW5nIHRoaXMgdHJhbnNpdGlvbmFsIHBlcmlvZCwgaW50ZXJwcmV0ZWQgbGFuZ3VhZ2VzIHRoYXQg bG9hZCB0aGUKK0dJUmVwb3NpdG9yeSBuYW1lc3BhY2UgY291bGQgZ2V0IHRoZSAid3JvbmciIHZl cnNpb24sIHdoaWNoIHdpbGwgcmVzdWx0CitpbiBhZGp1c3RpbmcgYSBzZWFyY2ggcGF0aCB0aGF0 IHdpbGwgbm90IGFjdHVhbGx5IGFmZmVjdCB0aGUgbGFuZ3VhZ2UKK2JpbmRpbmcncyB0eXBlbGli IGxvb2t1cCwgYW5kIGNvdWxkIGFsc28gbGVhZCB0byBzeW1ib2wgYW5kIHR5cGUtc3lzdGVtCitj b25mbGljdHMuCisKK1dlIGNhbiBhdm9pZCB0aGlzIGNvbGxpc2lvbiBieSBtYWtpbmcgR0xpYidz IEdJUmVwb3NpdG9yeSBsaWJyYXJ5IHJlZnVzZQordG8gbG9hZCB2ZXJzaW9ucyBvZiB0aGUgR0lS ZXBvc2l0b3J5IHR5cGVsaWIgdGhhdCBhcmUgbm90IDMuMCwgYW5kCitzaW1pbGFybHkgbWFraW5n IGdvYmplY3QtaW50cm9zcGVjdGlvbidzIEdJUmVwb3NpdG9yeSBsaWJyYXJ5IHJlZnVzZSB0bwor bG9hZCB0eXBlbGliIHZlcnNpb25zIHRoYXQgYXJlIG5vdCAyLjAuIEEgcmVsYXRpdmVseSBuZWF0 IHdheSB0byBhY2hpZXZlCit0aGF0IGlzIHRvIG1ha2UgZWFjaCB2ZXJzaW9uIGJlaGF2ZSBhcyBp ZiB0aGUgb3RoZXIgb25lIGRvZXNuJ3QgZXhpc3QuCisKK1NpZ25lZC1vZmYtYnk6IFNpbW9uIE1j Vml0dGllIDxzbWN2QGRlYmlhbi5vcmc+CistLS0KKyBnaXJlcG9zaXRvcnkvZ2lyZXBvc2l0b3J5 LmMgfCAyNyArKysrKysrKysrKysrKysrKysrKysrKysrKysKKyAxIGZpbGUgY2hhbmdlZCwgMjcg aW5zZXJ0aW9ucygrKQorCitkaWZmIC0tZ2l0IGEvZ2lyZXBvc2l0b3J5L2dpcmVwb3NpdG9yeS5j IGIvZ2lyZXBvc2l0b3J5L2dpcmVwb3NpdG9yeS5jCitpbmRleCAyMDZjZTE3MzcxLi4wMGQwOGQ0 MmRjIDEwMDY0NAorLS0tIGEvZ2lyZXBvc2l0b3J5L2dpcmVwb3NpdG9yeS5jCisrKysgYi9naXJl cG9zaXRvcnkvZ2lyZXBvc2l0b3J5LmMKK0BAIC01Nyw2ICs1NywxNCBAQAorICAqIFNpbmNlOiAy LjgwCisgICovCisgCisrLyogVGhlIG5hbWVzcGFjZSBhbmQgdmVyc2lvbiBjb3JyZXNwb25kaW5n IHRvIGxpYmdpcmVwb3NpdG9yeSBpdHNlbGYsIHNvCisrICogdGhhdCB3ZSBjYW4gcmVmdXNlIHRv IGxvYWQgdHlwZWxpYnMgY29ycmVzcG9uZGluZyB0byB0aGUgb2xkZXIsCisrICogaW5jb21wYXRp YmxlIHZlcnNpb24gb2YgdGhpcyBzYW1lIGxpYnJhcnkgaW4gZ29iamVjdC1pbnRyb3NwZWN0aW9u LiAqLworKyNkZWZpbmUgR0lSRVBPU0lUT1JZX1RZUEVMSUJfTkFNRSAiR0lSZXBvc2l0b3J5Igor KyNkZWZpbmUgR0lSRVBPU0lUT1JZX1RZUEVMSUJfVkVSU0lPTiAiMy4wIgorKyNkZWZpbmUgR0lS RVBPU0lUT1JZX1RZUEVMSUJfRklMRU5BTUUgXAorKyAgR0lSRVBPU0lUT1JZX1RZUEVMSUJfTkFN RSAiLSIgR0lSRVBPU0lUT1JZX1RZUEVMSUJfVkVSU0lPTiAiLnR5cGVsaWIiCisrCisgc3RhdGlj IEdJUmVwb3NpdG9yeSAqZGVmYXVsdF9yZXBvc2l0b3J5ID0gTlVMTDsKKyBzdGF0aWMgR1B0ckFy cmF5ICp0eXBlbGliX3NlYXJjaF9wYXRoID0gTlVMTDsKKyAKK0BAIC0xMzIzLDYgKzEzMzEsMTYg QEAgZmluZF9uYW1lc3BhY2VfdmVyc2lvbiAoY29uc3QgY2hhciAgICAgICAgICAqbmFtZXNwYWNl LAorICAgR01hcHBlZEZpbGUgKm1maWxlID0gTlVMTDsKKyAgIGNoYXIgKmZuYW1lOworIAorKyAg aWYgKGdfc3RyX2VxdWFsIChuYW1lc3BhY2UsIEdJUkVQT1NJVE9SWV9UWVBFTElCX05BTUUpICYm CisrICAgICAgIWdfc3RyX2VxdWFsICh2ZXJzaW9uLCBHSVJFUE9TSVRPUllfVFlQRUxJQl9WRVJT SU9OKSkKKysgICAgeworKyAgICAgIGdfZGVidWcgKCJJZ25vcmluZyAlcy0lcy50eXBlbGliIGJl Y2F1c2UgdGhpcyBsaWJnaXJlcG9zaXRvcnkgIgorKyAgICAgICAgICAgICAgICJjb3JyZXNwb25k cyB0byAlcy0lcyIsCisrICAgICAgICAgICAgICAgbmFtZXNwYWNlLCB2ZXJzaW9uLAorKyAgICAg ICAgICAgICAgIG5hbWVzcGFjZSwgR0lSRVBPU0lUT1JZX1RZUEVMSUJfVkVSU0lPTik7CisrICAg ICAgcmV0dXJuIE5VTEw7CisrICAgIH0KKysKKyAgIGZuYW1lID0gZ19zdHJkdXBfcHJpbnRmICgi JXMtJXMudHlwZWxpYiIsIG5hbWVzcGFjZSwgdmVyc2lvbik7CisgCisgICBmb3IgKHNpemVfdCBp ID0gMDsgaSA8IG5fc2VhcmNoX3BhdGhzOyArK2kpCitAQCAtMTQ3Nyw2ICsxNDk1LDE1IEBAIGVu dW1lcmF0ZV9uYW1lc3BhY2VfdmVyc2lvbnMgKGNvbnN0IGNoYXIgICAgICAgICAqbmFtZXNwYWNl LAorIAkgICAgICBjb25zdCBjaGFyICpuYW1lX2VuZDsKKyAJICAgICAgaW50IG1ham9yLCBtaW5v cjsKKyAKKysJICAgICAgaWYgKGdfc3RyX2VxdWFsIChuYW1lc3BhY2UsIEdJUkVQT1NJVE9SWV9U WVBFTElCX05BTUUpICYmCisrCQkgICFnX3N0cl9lcXVhbCAoZW50cnksIEdJUkVQT1NJVE9SWV9U WVBFTElCX0ZJTEVOQU1FKSkKKysJCXsKKysJCSAgZ19kZWJ1ZyAoIklnbm9yaW5nICVzIGJlY2F1 c2UgdGhpcyBsaWJnaXJlcG9zaXRvcnkgIgorKwkJCSAgICJjb3JyZXNwb25kcyB0byAlcyIsCisr CQkJICAgZW50cnksIEdJUkVQT1NJVE9SWV9UWVBFTElCX0ZJTEVOQU1FKTsKKysJCSAgY29udGlu dWU7CisrCQl9CisrCisgCSAgICAgIG5hbWVfZW5kID0gc3RycmNociAoZW50cnksICcuJyk7Cisg CSAgICAgIGxhc3RfZGFzaCA9IHN0cnJjaHIgKGVudHJ5LCAnLScpOworIAkgICAgICB2ZXJzaW9u ID0gZ19zdHJuZHVwIChsYXN0X2Rhc2grMSwgbmFtZV9lbmQtKGxhc3RfZGFzaCsxKSk7CistLSAK K0dpdExhYgorCgpkaWZmIC0tZ2l0IGEvZ2xpYjIuc3BlYyBiL2dsaWIyLnNwZWMKaW5kZXggNWIz MWJhMi4uYTJkZmRhNCAxMDA2NDQKLS0tIGEvZ2xpYjIuc3BlYworKysgYi9nbGliMi5zcGVjCkBA IC0xNiw2ICsxNiwxMCBAQCBQYXRjaDogICAgICAgICAgZ251dGxzLWhtYWMucGF0Y2gKICMgdGhl IGJhcmVtZXRhbCBEb2NrZXIgaXMgdXBkYXRlZCB0aGVyZSBpLmUuIGxldHMgYmUgYSBsaXR0bGUg Yml0IHByYWdtYXRpYy4uLgogUGF0Y2g6ICAgICAgICAgIGdzcGF3bi1lcGVybS5wYXRjaAogCisj IEJhY2twb3J0ZWQgZnJvbSB1cHN0cmVhbQorIyBodHRwczovL2dpdGxhYi5nbm9tZS5vcmcvR05P TUUvZ2xpYi8tL21lcmdlX3JlcXVlc3RzLzM3OTUKK1BhdGNoOiAgICAgICAgICAzNzk1LnBhdGNo CisKIEJ1aWxkUmVxdWlyZXM6ICBnY2MKIEJ1aWxkUmVxdWlyZXM6ICBnY2MtYysrCiBCdWlsZFJl cXVpcmVzOiAgZ2V0dGV4dAo=