From 58aedd45baf9406ed36e9e90b554d3a689440b7d Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Thu, 15 Oct 2026 21:02:18 +0200 Subject: [PATCH] package/libglib2: backport upstream security fix for CVE-2026-58016 Fixes the following vulnerability: CVE-2026-58016: A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service. https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5156 Backport the upstream patch (included in 2.89.0), but drop the test addition for easier backport: https://gitlab.gnome.org/GNOME/glib/-/commit/c9da977c178fbfc0e4caf99f9fdf5dc433d6fcc2 Signed-off-by: Peter Korsgaard Signed-off-by: Fiona Klute --- ...on-Fix-XML-parser-state-handling-for.patch | 42 +++++++++++++++++++ package/libglib2/libglib2.mk | 3 ++ 2 files changed, 45 insertions(+) create mode 100644 package/libglib2/0001-gdbusintrospection-Fix-XML-parser-state-handling-for.patch diff --git a/package/libglib2/0001-gdbusintrospection-Fix-XML-parser-state-handling-for.patch b/package/libglib2/0001-gdbusintrospection-Fix-XML-parser-state-handling-for.patch new file mode 100644 index 0000000000..4582382f80 --- /dev/null +++ b/package/libglib2/0001-gdbusintrospection-Fix-XML-parser-state-handling-for.patch @@ -0,0 +1,42 @@ +From c9da977c178fbfc0e4caf99f9fdf5dc433d6fcc2 Mon Sep 17 00:00:00 2001 +From: Philip Withnall +Date: Thu, 16 Apr 2026 15:27:37 +0100 +Subject: [PATCH] gdbusintrospection: Fix XML parser state handling for + element nesting + +The check for whether a `` element in D-Bus introspection XML was +nested correctly was broken. `` elements can only be at the top +level, or nested immediately within another `` element. + +Fix the check and add some unit tests for it. + +Spotted by linhlhq as #YWH-PGM9867-204. The fix is mine, and the unit test +uses example XML strings adapted from their report. + +Signed-off-by: Philip Withnall + +Fixes: #3932 +CVE: CVE-2026-58016 +Upstream: https://gitlab.gnome.org/GNOME/glib/-/commit/c9da977c178fbfc0e4caf99f9fdf5dc433d6fcc2 +Signed-off-by: Peter Korsgaard +[Peter: drop tests] +--- + gio/gdbusintrospection.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/gio/gdbusintrospection.c b/gio/gdbusintrospection.c +index 1138ba9d7..4df8e87db 100644 +--- a/gio/gdbusintrospection.c ++++ b/gio/gdbusintrospection.c +@@ -1266,7 +1266,7 @@ parser_start_element (GMarkupParseContext *context, + /* ---------------------------------------------------------------------------------------------------- */ + if (strcmp (element_name, "node") == 0) + { +- if (!(g_slist_length (stack) >= 1 || strcmp (stack->next->data, "node") != 0)) ++ if (stack->next != NULL && strcmp (stack->next->data, "node") != 0) + { + g_set_error_literal (error, + G_MARKUP_ERROR, +-- +2.47.3 + diff --git a/package/libglib2/libglib2.mk b/package/libglib2/libglib2.mk index 45aa894b81..3770e8671a 100644 --- a/package/libglib2/libglib2.mk +++ b/package/libglib2/libglib2.mk @@ -17,6 +17,9 @@ LIBGLIB2_INSTALL_STAGING = YES LIBGLIB2_CFLAGS = $(TARGET_CFLAGS) LIBGLIB2_LDFLAGS = $(TARGET_LDFLAGS) $(TARGET_NLS_LIBS) +# 0001-gdbusintrospection-Fix-XML-parser-state-handling-for.patch +LIBGLIB2_IGNORE_CVES += CVE-2026-58016 + # glib/valgrind.h contains inline asm not compatible with thumb1 ifeq ($(BR2_ARM_INSTRUCTIONS_THUMB),y) LIBGLIB2_CFLAGS += -marm