mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-27 04:20:38 -09:00
5c906d4a31
Fixes CVE-2025-14087: A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings. https://gitlab.gnome.org/GNOME/glib/-/issues/3834 The fixes were applied upstream as part of 2.86.3, so backport them for the 2.82.5 version currently used by Buildroot LTS. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Perale <thomas.perale@mind.be>
73 lines
2.3 KiB
Diff
73 lines
2.3 KiB
Diff
From c4a9a331b8a120cb2b44cab4bf93e331e8d87dea Mon Sep 17 00:00:00 2001
|
|
From: Philip Withnall <pwithnall@gnome.org>
|
|
Date: Tue, 25 Nov 2025 19:02:56 +0000
|
|
Subject: [PATCH] gvariant-parser: Fix potential integer overflow parsing
|
|
(byte)strings
|
|
|
|
The termination condition for parsing string and bytestring literals in
|
|
GVariant text format input was subject to an integer overflow for input
|
|
string (or bytestring) literals longer than `INT_MAX`.
|
|
|
|
Fix that by counting as a `size_t` rather than as an `int`. The counter
|
|
can never correctly be negative.
|
|
|
|
Spotted by treeplus. Thanks to the Sovereign Tech Resilience programme
|
|
from the Sovereign Tech Agency. ID: #YWH-PGM9867-145
|
|
|
|
CVE: CVE-2025-14087
|
|
Upstream: https://gitlab.gnome.org/GNOME/glib/-/commit/3e72fe0fbb32c18a66486c4da8bc851f656af287
|
|
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
|
|
Fixes: #3834
|
|
(cherry picked from commit 3e72fe0fbb32c18a66486c4da8bc851f656af287)
|
|
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
|
---
|
|
glib/gvariant-parser.c | 10 +++++-----
|
|
1 file changed, 5 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/glib/gvariant-parser.c b/glib/gvariant-parser.c
|
|
index 8bd16766c..6331e0c95 100644
|
|
--- a/glib/gvariant-parser.c
|
|
+++ b/glib/gvariant-parser.c
|
|
@@ -597,7 +597,7 @@ ast_resolve (AST *ast,
|
|
{
|
|
GVariant *value;
|
|
gchar *pattern;
|
|
- gint i, j = 0;
|
|
+ size_t i, j = 0;
|
|
|
|
pattern = ast_get_pattern (ast, error);
|
|
|
|
@@ -1621,9 +1621,9 @@ string_free (AST *ast)
|
|
* No leading/trailing space allowed. */
|
|
static gboolean
|
|
unicode_unescape (const gchar *src,
|
|
- gint *src_ofs,
|
|
+ size_t *src_ofs,
|
|
gchar *dest,
|
|
- gint *dest_ofs,
|
|
+ size_t *dest_ofs,
|
|
gsize length,
|
|
SourceRef *ref,
|
|
GError **error)
|
|
@@ -1684,7 +1684,7 @@ string_parse (TokenStream *stream,
|
|
gsize length;
|
|
gchar quote;
|
|
gchar *str;
|
|
- gint i, j;
|
|
+ size_t i, j;
|
|
|
|
token_stream_start_ref (stream, &ref);
|
|
token = token_stream_get (stream);
|
|
@@ -1814,7 +1814,7 @@ bytestring_parse (TokenStream *stream,
|
|
gsize length;
|
|
gchar quote;
|
|
gchar *str;
|
|
- gint i, j;
|
|
+ size_t i, j;
|
|
|
|
token_stream_start_ref (stream, &ref);
|
|
token = token_stream_get (stream);
|
|
--
|
|
2.43.0
|
|
|