Google GitGoogle Git
Sign in
chromium/external/gitlab.gnome.org/GNOME/glib/refs/heads/upstream/mcatanzaro/glib-2-68-rhel9
commit
960a0aee45166c47ee39492bc12aec4e55aad398
[log]
author
Philip Withnall <pwithnall@gnome.org>
Thu Dec 04 16:37:19 2025
committer
Michael Catanzaro <mcatanzaro@gnome.org>
Fri Apr 24 21:58:37 2026
tree
4034dd466183539a8e865573364bc95085966817
parent
22b1d835647b1a9a4f9813c248ca6ae95c22a368 [diff]
gfileattribute: Fix integer overflow calculating escaping for byte strings

The number of invalid characters in the byte string (characters which
would have to be percent-encoded) was only stored in an `int`, which
gave the possibility of a long string largely full of invalid
characters overflowing this and allowing an attacker-controlled buffer
size to be allocated.

This could be triggered by an attacker controlled file attribute (of
type `G_FILE_ATTRIBUTE_TYPE_BYTE_STRING`), such as
`G_FILE_ATTRIBUTE_THUMBNAIL_PATH` or `G_FILE_ATTRIBUTE_STANDARD_NAME`,
being read by user code.

Spotted by Codean Labs.

Signed-off-by: Philip Withnall <pwithnall@gnome.org>

Fixes: #3845
1 file changed
tree: 4034dd466183539a8e865573364bc95085966817
  1. .gitlab-ci/
  2. docs/
  3. fuzzing/
  4. gio/
  5. glib/
  6. gmodule/
  7. gobject/
  8. gthread/
  9. m4macros/
  10. po/
  11. subprojects/
  12. tests/
  13. .clang-format
  14. .dir-locals.el
  15. .gitattributes
  16. .gitignore
  17. .gitlab-ci.yml
  18. AUTHORS
  19. check-abis.sh
  20. clang-format-diff.py
  21. CONTRIBUTING.md
  22. COPYING
  23. glib-gettextize.in
  24. glib.doap
  25. glib.supp
  26. HACKING
  27. INSTALL.in
  28. meson.build
  29. meson_options.txt
  30. msvc_recommended_pragmas.h
  31. NEWS
  32. NEWS.pre-1-3
  33. README
  34. README.md
  35. README.rationale
  36. README.win32
  37. README.win32.md
  38. template-tap.test.in
  39. template.test.in
README.md

GLib

GLib is the low-level core library that forms the basis for projects such as GTK and GNOME. It provides data structure handling for C, portability wrappers, and interfaces for such runtime functionality as an event loop, threads, dynamic loading, and an object system.

The official download locations are: https://download.gnome.org/sources/glib

The official web site is: https://www.gtk.org/

Installation

See the file ‘INSTALL.in’

How to report bugs

Bugs should be reported to the GNOME issue tracking system. (https://gitlab.gnome.org/GNOME/glib/issues/new). You will need to create an account for yourself.

In the bug report please include:

  • Information about your system. For instance:
    • What operating system and version
    • For Linux, what version of the C library
    • And anything else you think is relevant.
  • How to reproduce the bug.
    • If you can reproduce it with one of the test programs that are built in the tests/ subdirectory, that will be most convenient. Otherwise, please include a short test program that exhibits the behavior. As a last resort, you can also provide a pointer to a larger piece of software that can be downloaded.
  • If the bug was a crash, the exact text that was printed out when the crash occurred.
  • Further information such as stack traces may be useful, but is not necessary.

Patches

Patches should also be submitted as merge requests to gitlab.gnome.org. If the patch fixes an existing issue, please refer to the issue in your commit message with the following notation (for issue 123): Closes: #123

Otherwise, create a new merge request that introduces the change, filing a separate issue is not required.