mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-10-23 01:11:53 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/libglib2: backport upstream security fix for CVE-2026-58016

Browse Source 
Fixes the following vulnerability:

CVE-2026-58016: A flaw was found in GLib.  A state confusion issue exists in
g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when
processing malformed D-Bus introspection XML, specifically with a `node`
element nested within other elements like `method`, `signal`, `property` or
`arg`.  This issue can cause an unsigned integer overflow and lead to an
out-of-bounds read, resulting in a denial of service.

https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5156

Backport the upstream patch (included in 2.89.0), but drop the test addition
for easier backport:

c9da977c17

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
This commit is contained in:
Peter Korsgaard
2026-10-15 21:02:18 +02:00
committed by Fiona Klute
parent 112fd25dc6
commit 58aedd45ba
2 changed files with 45 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
package/libglib2/0001-gdbusintrospection-Fix-XML-parser-state-handling-for.patch Normal file
View File

@@ -0,0 +1,42 @@
From c9da977c178fbfc0e4caf99f9fdf5dc433d6fcc2 Mon Sep 17 00:00:00 2001
From: Philip Withnall <pwithnall@gnome.org>
Date: Thu, 16 Apr 2026 15:27:37 +0100
Subject: [PATCH] gdbusintrospection: Fix XML parser state handling for <node>
element nesting
The check for whether a `<node>` element in D-Bus introspection XML was
nested correctly was broken. `<node>` elements can only be at the top
level, or nested immediately within another `<node>` element.
Fix the check and add some unit tests for it.
Spotted by linhlhq as #YWH-PGM9867-204. The fix is mine, and the unit test
uses example XML strings adapted from their report.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Fixes: #3932
CVE: CVE-2026-58016
Upstream: https://gitlab.gnome.org/GNOME/glib/-/commit/c9da977c178fbfc0e4caf99f9fdf5dc433d6fcc2
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[Peter: drop tests]
---
gio/gdbusintrospection.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/gio/gdbusintrospection.c b/gio/gdbusintrospection.c
index 1138ba9d7..4df8e87db 100644
--- a/gio/gdbusintrospection.c
+++ b/gio/gdbusintrospection.c
@@ -1266,7 +1266,7 @@ parser_start_element (GMarkupParseContext *context,
/* ---------------------------------------------------------------------------------------------------- */
if (strcmp (element_name, "node") == 0)
{
- if (!(g_slist_length (stack) >= 1 || strcmp (stack->next->data, "node") != 0))
+ if (stack->next != NULL && strcmp (stack->next->data, "node") != 0)
{
g_set_error_literal (error,
G_MARKUP_ERROR,
--
2.47.3

3
package/libglib2/libglib2.mk
View File

@@ -17,6 +17,9 @@ LIBGLIB2_INSTALL_STAGING = YES
LIBGLIB2_CFLAGS = $(TARGET_CFLAGS)
LIBGLIB2_LDFLAGS = $(TARGET_LDFLAGS) $(TARGET_NLS_LIBS)
# 0001-gdbusintrospection-Fix-XML-parser-state-handling-for.patch
LIBGLIB2_IGNORE_CVES += CVE-2026-58016
# glib/valgrind.h contains inline asm not compatible with thumb1
ifeq ($(BR2_ARM_INSTRUCTIONS_THUMB),y)
LIBGLIB2_CFLAGS += -marm