[rpms/glib2] cve-2026-58016-f44: Update to 2.81.0

[nmontero <nmontero@redhat.com>]

A new commit has been pushed.

Repo   : rpms/glib2
Branch : cve-2026-58016-f44
Commit : 9a5b9c27124679f83e7e1d394d6eeba0c8fef0a3
Author : nmontero <nmontero@redhat.com>
Date   : 2024-07-29T11:06:00+00:00
Stats  : +94/-49 in 3 file(s)
URL    : https://src.fedoraproject.org/rpms/glib2/c/9a5b9c27124679f83e7e1d394d6eeba0c8fef0a3?branch=cve-2026-58016-f44

Log:
Update to 2.81.0

---
diff --git a/glib2.spec b/glib2.spec
index 363db1f..3bc8804 100644
--- a/glib2.spec
+++ b/glib2.spec
@@ -1,11 +1,11 @@
 Name:           glib2
-Version:        2.80.3
+Version:        2.81.0
 Release:        %autorelease
 Summary:        A library of handy utility functions
 
 License:        LGPL-2.1-or-later
 URL:            https://www.gtk.org
-Source:         https://download.gnome.org/sources/glib/2.80/glib-%{version}.tar.xz
+Source:         https://download.gnome.org/sources/glib/2.81/glib-%{version}.tar.xz
 
 # Required for RHEL core crypto components policy. Good for Fedora too.
 # https://bugzilla.redhat.com/show_bug.cgi?id=1630260
@@ -107,8 +107,8 @@ the functionality of the installed glib2 package.
 
 %build
 %meson \
-    -Ddtrace=true \
-    -Dsystemtap=true \
+    -Ddtrace=enabled \
+    -Dsystemtap=enabled \
     -Dsysprof=enabled \
     -Ddocumentation=true \
     -Dinstalled_tests=true \

diff --git a/gnutls-hmac.patch b/gnutls-hmac.patch
index e9c9b0d..f01fb9c 100644
--- a/gnutls-hmac.patch
+++ b/gnutls-hmac.patch
@@ -1,4 +1,4 @@
-From 79c6d81cad24e488c8c17fb5043f29fef11a245e Mon Sep 17 00:00:00 2001
+From 9ef5cacbf93640434b4d4ac425f87efb79aacc5d Mon Sep 17 00:00:00 2001
 From: Colin Walters <walters@verbum.org>
 Date: Fri, 7 Jun 2019 18:44:43 +0000
 Subject: [PATCH 1/4] ghmac: Split off wrapper functions into ghmac-utils.c
@@ -284,7 +284,7 @@ index 97e2fff90..de89d826d 100644
 -                                  (const guchar *) str, length);
 -}
 diff --git a/glib/meson.build b/glib/meson.build
-index d2efebadc..d261dde5a 100644
+index b5545b63b..c631a8a0a 100644
 --- a/glib/meson.build
 +++ b/glib/meson.build
 @@ -289,6 +289,7 @@ glib_sources += files(
@@ -299,7 +299,7 @@ index d2efebadc..d261dde5a 100644
 2.45.2
 
 
-From 6be9a415a7af65a2cee5518e87a3f313068a2e0e Mon Sep 17 00:00:00 2001
+From 3ef71255bb2ff257830643b7de6e257174b0898d Mon Sep 17 00:00:00 2001
 From: Colin Walters <walters@verbum.org>
 Date: Fri, 7 Jun 2019 19:36:54 +0000
 Subject: [PATCH 2/4] Add a gnutls backend for GHmac
@@ -355,7 +355,7 @@ https://gitlab.gnome.org/GNOME/glib/-/merge_requests/903
  glib/ghmac.c            |  15 ++++
  glib/meson.build        |  10 ++-
  meson.build             |   7 ++
- meson_options.txt       |   5 ++
+ meson.options           |   5 ++
  7 files changed, 260 insertions(+), 5 deletions(-)
  create mode 100644 glib/gchecksumprivate.h
  create mode 100644 glib/ghmac-gnutls.c
@@ -660,7 +660,7 @@ index de89d826d..616e167e7 100644
   *   Use g_hmac_unref() to free the memory allocated by it.
   *
 diff --git a/glib/meson.build b/glib/meson.build
-index d261dde5a..b3663f184 100644
+index c631a8a0a..c5f6c1680 100644
 --- a/glib/meson.build
 +++ b/glib/meson.build
 @@ -288,7 +288,6 @@ glib_sources += files(
@@ -693,19 +693,19 @@ index d261dde5a..b3663f184 100644
  pcre2_static_args = []
  
  if use_pcre2_static_flag
-@@ -421,6 +428,7 @@ libglib = library('glib-2.0',
-   link_with: [charset_lib, gnulib_lib],
+@@ -422,6 +429,7 @@ libglib = library('glib-2.0',
    dependencies : [
+     atomic_dep,
      gnulib_libm_dependency,
 +    libgnutls_dep,
      libiconv,
      libintl_deps,
      libm,
 diff --git a/meson.build b/meson.build
-index 85e24aa69..34d14f90a 100644
+index 29b61fc40..f11f3737b 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -2286,6 +2286,13 @@ if host_system == 'linux'
+@@ -2324,6 +2324,13 @@ if host_system == 'linux'
    endif
  endif
  
@@ -719,10 +719,10 @@ index 85e24aa69..34d14f90a 100644
  if host_system == 'windows'
    winsock2 = cc.find_library('ws2_32')
  else
-diff --git a/meson_options.txt b/meson_options.txt
-index 69a2135bc..e8599abaa 100644
---- a/meson_options.txt
-+++ b/meson_options.txt
+diff --git a/meson.options b/meson.options
+index 14ece1039..7f607cd89 100644
+--- a/meson.options
++++ b/meson.options
 @@ -37,6 +37,11 @@ option('libmount',
         value : 'auto',
         description : 'build with libmount support')
@@ -739,7 +739,7 @@ index 69a2135bc..e8599abaa 100644
 2.45.2
 
 
-From 678df1ffadcd7fa326d4c5234dd4dbf561f3d09c Mon Sep 17 00:00:00 2001
+From 780c2e18fcb0747cd87d2d6c373781cb63761e7f Mon Sep 17 00:00:00 2001
 From: Michael Catanzaro <mcatanzaro@redhat.com>
 Date: Wed, 16 Jun 2021 20:35:00 -0500
 Subject: [PATCH 3/4] dlopen GnuTLS instead of linking directly
@@ -921,22 +921,22 @@ index 616e167e7..ddb163557 100644
  #endif
  
 diff --git a/glib/meson.build b/glib/meson.build
-index b3663f184..2340d12b2 100644
+index c5f6c1680..eca58df81 100644
 --- a/glib/meson.build
 +++ b/glib/meson.build
-@@ -428,7 +428,6 @@ libglib = library('glib-2.0',
-   link_with: [charset_lib, gnulib_lib],
+@@ -429,7 +429,6 @@ libglib = library('glib-2.0',
    dependencies : [
+     atomic_dep,
      gnulib_libm_dependency,
 -    libgnutls_dep,
      libiconv,
      libintl_deps,
      libm,
 diff --git a/meson.build b/meson.build
-index 34d14f90a..1e6e14554 100644
+index f11f3737b..988ae5ade 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -2286,11 +2286,9 @@ if host_system == 'linux'
+@@ -2324,11 +2324,9 @@ if host_system == 'linux'
    endif
  endif
  
@@ -954,19 +954,27 @@ index 34d14f90a..1e6e14554 100644
 2.45.2
 
 
-From c76bfa6e30ee14bcfb19666ec3e1f3bd379143bd Mon Sep 17 00:00:00 2001
+From 267152754263fa9a0f67b8f5313ada392a87793c Mon Sep 17 00:00:00 2001
 From: Michael Catanzaro <mcatanzaro@redhat.com>
 Date: Wed, 16 Jun 2021 20:46:24 -0500
-Subject: [PATCH 4/4] Disable MD5 and SHA-1 HMac tests
+Subject: [PATCH 4/4] Add test for GHmac in FIPS mode
 
-These are expected to be broken, depending on system crypto policy,
-which may disable the algorithms.
+This will test a few problems that we hit recently:
+
+g_hmac_copy() is broken, https://bugzilla.redhat.com/show_bug.cgi?id=1786538
+
+Crash in g_hmac_update() in FIPS mode, https://bugzilla.redhat.com/show_bug.cgi?id=1971533
+
+Crash when passing -1 length to g_hmac_update() (discovered in #1971533)
+
+We'll also test to ensure MD5 fails, and stop compiling the other MD5
+tests.
 ---
- glib/tests/hmac.c | 11 +++++++++++
- 1 file changed, 11 insertions(+)
+ glib/tests/hmac.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 46 insertions(+)
 
 diff --git a/glib/tests/hmac.c b/glib/tests/hmac.c
-index 3ac3206df..e7f3fdf08 100644
+index 3ac3206df..352d18a09 100644
 --- a/glib/tests/hmac.c
 +++ b/glib/tests/hmac.c
 @@ -1,7 +1,10 @@
@@ -996,34 +1004,61 @@ index 3ac3206df..e7f3fdf08 100644
  HmacCase hmac_md5_tests[] = {
    { G_CHECKSUM_MD5, key_md5_test1, 16, "Hi There", 8, result_md5_test1 },
    { G_CHECKSUM_MD5, "Jefe", 4, "what do ya want for nothing?", 28,
-@@ -336,6 +341,7 @@ HmacCase hmac_sha1_tests[] = {
-                " Than One Block-Size Data", 73, result_sha1_test7, },
+@@ -317,6 +322,7 @@ HmacCase hmac_md5_tests[] = {
+       73, result_md5_test7 },
    { -1, NULL, 0, NULL, 0, NULL },
  };
 +#endif
  
- HmacCase hmac_sha256_tests[] = {
-   { G_CHECKSUM_SHA256, key_sha_test1, 20, "Hi There", 8, result_sha256_test1 },
-@@ -498,8 +504,10 @@ main (int argc,
+ HmacCase hmac_sha1_tests[] = {
+   { G_CHECKSUM_SHA1, key_sha_test1, 20, "Hi There", 8, result_sha1_test1 },
+@@ -493,11 +499,45 @@ test_hmac_for_bytes (void)
+   g_bytes_unref (data);
+ }
+ 
++#ifdef USE_GNUTLS
++static void
++test_gnutls_fips_mode (void)
++{
++  GHmac *hmac;
++  GHmac *copy;
++
++  /* No MD5 in FIPS mode. */
++  hmac = g_hmac_new (G_CHECKSUM_MD5, (guchar*)"abc123", sizeof ("abc123"));
++  g_assert_null (hmac);
++
++  /* SHA-256 should be good. */
++  hmac = g_hmac_new (G_CHECKSUM_SHA256, (guchar*)"abc123", sizeof ("abc123"));
++  g_assert_nonnull (hmac);
++
++  /* Ensure g_hmac_update() does not crash when called with -1. */
++  g_hmac_update (hmac, (guchar*)"You win again, gravity!", -1);
++
++  /* Ensure g_hmac_copy() does not crash. */
++  copy = g_hmac_copy (hmac);
++  g_assert_nonnull (hmac);
++  g_hmac_unref (hmac);
++
++  g_assert_cmpstr (g_hmac_get_string (copy), ==, "795ba6900bcb22e8ce65c2ec02db4e85697da921deb960ee3143bf88a4a60f83");
++  g_hmac_unref (copy);
++}
++#endif
++
+ int
+ main (int argc,
      char **argv)
  {
    int i;
 +
++#ifdef USE_GNUTLS
++  /* This has to happen before GnuTLS is dlopened. */
++  g_setenv ("GNUTLS_FORCE_FIPS_MODE", "1", FALSE);
++#endif
++
    g_test_init (&argc, &argv, NULL);
  
-+#ifndef USE_GNUTLS
    for (i = 0 ; hmac_sha1_tests[i].key_len > 0 ; i++)
-     {
-       gchar *name = g_strdup_printf ("/hmac/sha1-%d", i + 1);
-@@ -507,6 +515,7 @@ main (int argc,
-         (void (*)(const void *)) test_hmac);
-       g_free (name);
-     }
-+#endif
- 
-   for (i = 0 ; hmac_sha256_tests[i].key_len > 0 ; i++)
-     {
-@@ -532,6 +541,7 @@ main (int argc,
+@@ -532,6 +572,7 @@ main (int argc,
        g_free (name);
      }
  
@@ -1031,7 +1066,7 @@ index 3ac3206df..e7f3fdf08 100644
    for (i = 0 ; hmac_md5_tests[i].key_len > 0 ; i++)
      {
        gchar *name = g_strdup_printf ("/hmac/md5-%d", i + 1);
-@@ -539,6 +549,7 @@ main (int argc,
+@@ -539,6 +580,7 @@ main (int argc,
          (void (*)(const void *)) test_hmac);
        g_free (name);
      }
@@ -1039,6 +1074,16 @@ index 3ac3206df..e7f3fdf08 100644
  
    g_test_add_func ("/hmac/ref-unref", test_hmac_ref_unref);
    g_test_add_func ("/hmac/copy", test_hmac_copy);
+@@ -546,5 +588,9 @@ main (int argc,
+   g_test_add_func ("/hmac/for-string", test_hmac_for_string);
+   g_test_add_func ("/hmac/for-bytes", test_hmac_for_bytes);
+ 
++#ifdef USE_GNUTLS
++  g_test_add_func ("/hmac/gnutls-fips-mode", test_gnutls_fips_mode);
++#endif
++
+   return g_test_run ();
+ }
 -- 
 2.45.2
 

diff --git a/sources b/sources
index acc2805..ad4a9cb 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (glib-2.80.3.tar.xz) = b9c40e912c386192538ebe91b8aefca0ef00c9536b83604826ec9d3f1b963837e3330edd25ab6e11b8d8e3a475b2ea0938753a6ea8f657c8fcc93c3288b600c5
+SHA512 (glib-2.81.0.tar.xz) = 545a9a98253f07d6a4c68bcdc377c9c1affe22504e4059bc5d385cb913a7e58d1bd2c09aa33c315871fc2c17b43e9d74bec4b8dcadb950920da31a79c8defe7e