Skip to content

Commit d0c6cd7

Browse files
authored
[MEDIUM] Patch glib for CVE-2025-4373 and CVE-2025-6052 (microsoft#13974)
1 parent 3d376b9 commit d0c6cd7

File tree

7 files changed

+163
-14
lines changed

7 files changed

+163
-14
lines changed

SPECS/glib/CVE-2025-4373.patch

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
From f8cd5f93b2ba7fedf79fd4572ad3275bc8b52f77 Mon Sep 17 00:00:00 2001
2+
From: Aninda <[email protected]>
3+
Date: Mon, 9 Jun 2025 07:06:12 -0400
4+
Subject: [PATCH] Address CVE-2025-4373
5+
Upstream Patch Reference: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4588.patch
6+
7+
---
8+
glib/gstring.c | 36 +++++++++++++++++++++++-------------
9+
1 file changed, 23 insertions(+), 13 deletions(-)
10+
11+
diff --git a/glib/gstring.c b/glib/gstring.c
12+
index 9f04144..d016b65 100644
13+
--- a/glib/gstring.c
14+
+++ b/glib/gstring.c
15+
@@ -490,8 +490,9 @@ g_string_insert_len (GString *string,
16+
return string;
17+
18+
if (len < 0)
19+
- len = strlen (val);
20+
- len_unsigned = len;
21+
+ len_unsigned = strlen (val);
22+
+ else
23+
+ len_unsigned = len;
24+
25+
if (pos < 0)
26+
pos_unsigned = string->len;
27+
@@ -788,10 +789,12 @@ g_string_insert_c (GString *string,
28+
g_string_maybe_expand (string, 1);
29+
30+
if (pos < 0)
31+
- pos = string->len;
32+
+ pos_unsigned = string->len;
33+
else
34+
- g_return_val_if_fail ((gsize) pos <= string->len, string);
35+
- pos_unsigned = pos;
36+
+ {
37+
+ pos_unsigned = pos;
38+
+ g_return_val_if_fail (pos_unsigned <= string->len, string);
39+
+ }
40+
41+
/* If not just an append, move the old stuff */
42+
if (pos_unsigned < string->len)
43+
@@ -824,6 +827,7 @@ g_string_insert_unichar (GString *string,
44+
gssize pos,
45+
gunichar wc)
46+
{
47+
+ gsize pos_unsigned;
48+
gint charlen, first, i;
49+
gchar *dest;
50+
51+
@@ -865,15 +869,18 @@ g_string_insert_unichar (GString *string,
52+
g_string_maybe_expand (string, charlen);
53+
54+
if (pos < 0)
55+
- pos = string->len;
56+
+ pos_unsigned = string->len;
57+
else
58+
- g_return_val_if_fail ((gsize) pos <= string->len, string);
59+
+ {
60+
+ pos_unsigned = pos;
61+
+ g_return_val_if_fail (pos_unsigned <= string->len, string);
62+
+ }
63+
64+
/* If not just an append, move the old stuff */
65+
- if ((gsize) pos < string->len)
66+
- memmove (string->str + pos + charlen, string->str + pos, string->len - pos);
67+
+ if (pos_unsigned < string->len)
68+
+ memmove (string->str + pos_unsigned + charlen, string->str + pos_unsigned, string->len - pos_unsigned);
69+
70+
- dest = string->str + pos;
71+
+ dest = string->str + pos_unsigned;
72+
/* Code copied from g_unichar_to_utf() */
73+
for (i = charlen - 1; i > 0; --i)
74+
{
75+
@@ -931,6 +938,7 @@ g_string_overwrite_len (GString *string,
76+
const gchar *val,
77+
gssize len)
78+
{
79+
+ gssize len_unsigned;
80+
gsize end;
81+
82+
g_return_val_if_fail (string != NULL, NULL);
83+
@@ -942,14 +950,16 @@ g_string_overwrite_len (GString *string,
84+
g_return_val_if_fail (pos <= string->len, string);
85+
86+
if (len < 0)
87+
- len = strlen (val);
88+
+ len_unsigned = strlen (val);
89+
+ else
90+
+ len_unsigned = len;
91+
92+
- end = pos + len;
93+
+ end = pos + len_unsigned;
94+
95+
if (end > string->len)
96+
g_string_maybe_expand (string, end - string->len);
97+
98+
- memcpy (string->str + pos, val, len);
99+
+ memcpy (string->str + pos, val, len_unsigned);
100+
101+
if (end > string->len)
102+
{
103+
--
104+
2.34.1
105+

SPECS/glib/CVE-2025-6052.patch

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
From fc1479f9951f046198bb50c89b052f9c0ad09a06 Mon Sep 17 00:00:00 2001
2+
From: Aninda <[email protected]>
3+
Date: Sun, 22 Jun 2025 08:32:39 -0400
4+
Subject: [PATCH] Address CVE-2025-6052
5+
6+
Upstream Patch Reference: https://gitlab.gnome.org/GNOME/glib/-/commit/37eecaa7efc48a0df22277444ff25ff791ac0ac1
7+
---
8+
glib/gstring.c | 8 ++++----
9+
1 file changed, 4 insertions(+), 4 deletions(-)
10+
11+
diff --git a/glib/gstring.c b/glib/gstring.c
12+
index d016b65..75f7853 100644
13+
--- a/glib/gstring.c
14+
+++ b/glib/gstring.c
15+
@@ -78,10 +78,6 @@ static void
16+
g_string_expand (GString *string,
17+
gsize len)
18+
{
19+
- /* Detect potential overflow */
20+
- if G_UNLIKELY ((G_MAXSIZE - string->len - 1) < len)
21+
- g_error ("adding %" G_GSIZE_FORMAT " to string would overflow", len);
22+
-
23+
string->allocated_len = g_nearest_pow (string->len + len + 1);
24+
/* If the new size is bigger than G_MAXSIZE / 2, only allocate enough
25+
* memory for this string and don't over-allocate.
26+
@@ -96,6 +92,10 @@ static inline void
27+
g_string_maybe_expand (GString *string,
28+
gsize len)
29+
{
30+
+ /* Detect potential overflow */
31+
+ if G_UNLIKELY ((G_MAXSIZE - string->len - 1) < len)
32+
+ g_error ("adding %" G_GSIZE_FORMAT " to string would overflow", len);
33+
+
34+
if (G_UNLIKELY (string->len + len >= string->allocated_len))
35+
g_string_expand (string, len);
36+
}
37+
--
38+
2.34.1
39+

SPECS/glib/glib.spec

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Summary: Low-level libraries useful for providing data structure handling for C.
33
Name: glib
44
Version: 2.78.6
5-
Release: 2%{?dist}
5+
Release: 3%{?dist}
66
License: LGPLv2+
77
Vendor: Microsoft Corporation
88
Distribution: Azure Linux
@@ -11,6 +11,8 @@ URL: https://developer.gnome.org/glib/
1111
Source0: https://ftp.gnome.org/pub/gnome/sources/glib/%{majorver}/%{name}-%{version}.tar.xz
1212
Patch0: CVE-2024-52533.patch
1313
Patch1: CVE-2025-3360.patch
14+
Patch2: CVE-2025-4373.patch
15+
Patch3: CVE-2025-6052.patch
1416
BuildRequires: cmake
1517
BuildRequires: gtk-doc
1618
BuildRequires: libffi-devel
@@ -90,7 +92,7 @@ touch %{buildroot}%{_libdir}/gio/modules/giomodule.cache
9092

9193
%files
9294
%defattr(-,root,root)
93-
%license COPYING
95+
%license LICENSES/LGPL-2.1-or-later.txt
9496
%{_libdir}/libglib-*.so.*
9597
%{_libdir}/libgthread-*.so.*
9698
%{_libdir}/libgmodule-*.so.*
@@ -123,6 +125,9 @@ touch %{buildroot}%{_libdir}/gio/modules/giomodule.cache
123125
%doc %{_datadir}/gtk-doc/html/*
124126

125127
%changelog
128+
* Mon Jun 09 2025 Aninda Pradhan <[email protected]> - 2.78.6-3
129+
- Patch CVE-2025-4373 and CVE-2025-6052.patch
130+
126131
* Wed Apr 16 2025 Archana Shettigar <[email protected]> - 2.78.6-2
127132
- Patch CVE-2025-3360
128133

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -208,7 +208,7 @@ libxml2-devel-2.11.5-6.azl3.aarch64.rpm
208208
docbook-dtd-xml-4.5-11.azl3.noarch.rpm
209209
docbook-style-xsl-1.79.1-14.azl3.noarch.rpm
210210
libsepol-3.6-2.azl3.aarch64.rpm
211-
glib-2.78.6-2.azl3.aarch64.rpm
211+
glib-2.78.6-3.azl3.aarch64.rpm
212212
libltdl-2.4.7-1.azl3.aarch64.rpm
213213
libltdl-devel-2.4.7-1.azl3.aarch64.rpm
214214
lua-5.4.6-1.azl3.aarch64.rpm

toolkit/resources/manifests/package/pkggen_core_x86_64.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -208,7 +208,7 @@ libxml2-devel-2.11.5-6.azl3.x86_64.rpm
208208
docbook-dtd-xml-4.5-11.azl3.noarch.rpm
209209
docbook-style-xsl-1.79.1-14.azl3.noarch.rpm
210210
libsepol-3.6-2.azl3.x86_64.rpm
211-
glib-2.78.6-2.azl3.x86_64.rpm
211+
glib-2.78.6-3.azl3.x86_64.rpm
212212
libltdl-2.4.7-1.azl3.x86_64.rpm
213213
libltdl-devel-2.4.7-1.azl3.x86_64.rpm
214214
lua-5.4.6-1.azl3.x86_64.rpm

toolkit/resources/manifests/package/toolchain_aarch64.txt

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -122,11 +122,11 @@ gdbm-lang-1.23-1.azl3.aarch64.rpm
122122
gettext-0.22-1.azl3.aarch64.rpm
123123
gettext-debuginfo-0.22-1.azl3.aarch64.rpm
124124
gfortran-13.2.0-7.azl3.aarch64.rpm
125-
glib-2.78.6-2.azl3.aarch64.rpm
126-
glib-debuginfo-2.78.6-2.azl3.aarch64.rpm
127-
glib-devel-2.78.6-2.azl3.aarch64.rpm
128-
glib-doc-2.78.6-2.azl3.noarch.rpm
129-
glib-schemas-2.78.6-2.azl3.aarch64.rpm
125+
glib-2.78.6-3.azl3.aarch64.rpm
126+
glib-debuginfo-2.78.6-3.azl3.aarch64.rpm
127+
glib-devel-2.78.6-3.azl3.aarch64.rpm
128+
glib-doc-2.78.6-3.azl3.noarch.rpm
129+
glib-schemas-2.78.6-3.azl3.aarch64.rpm
130130
glibc-2.38-11.azl3.aarch64.rpm
131131
glibc-debuginfo-2.38-11.azl3.aarch64.rpm
132132
glibc-devel-2.38-11.azl3.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -129,11 +129,11 @@ gdbm-lang-1.23-1.azl3.x86_64.rpm
129129
gettext-0.22-1.azl3.x86_64.rpm
130130
gettext-debuginfo-0.22-1.azl3.x86_64.rpm
131131
gfortran-13.2.0-7.azl3.x86_64.rpm
132-
glib-2.78.6-2.azl3.x86_64.rpm
133-
glib-debuginfo-2.78.6-2.azl3.x86_64.rpm
134-
glib-devel-2.78.6-2.azl3.x86_64.rpm
135-
glib-doc-2.78.6-2.azl3.noarch.rpm
136-
glib-schemas-2.78.6-2.azl3.x86_64.rpm
132+
glib-2.78.6-3.azl3.x86_64.rpm
133+
glib-debuginfo-2.78.6-3.azl3.x86_64.rpm
134+
glib-devel-2.78.6-3.azl3.x86_64.rpm
135+
glib-doc-2.78.6-3.azl3.noarch.rpm
136+
glib-schemas-2.78.6-3.azl3.x86_64.rpm
137137
glibc-2.38-11.azl3.x86_64.rpm
138138
glibc-debuginfo-2.38-11.azl3.x86_64.rpm
139139
glibc-devel-2.38-11.azl3.x86_64.rpm

0 commit comments

Comments
 (0)