Skip to content

Commit cac3d54

Browse files
authored
[LOW] Patch glib for CVE-2025-3360 (#13428)
1 parent 749b9bf commit cac3d54

File tree

6 files changed

+155
-13
lines changed

6 files changed

+155
-13
lines changed

SPECS/glib/CVE-2025-3360.patch

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
From 407e37b2f0464eee439866e9c15d626cfb06a072 Mon Sep 17 00:00:00 2001
2+
From: archana25-ms <[email protected]>
3+
Date: Wed, 16 Apr 2025 05:26:51 +0000
4+
Subject: [PATCH] Address CVE-2025-3360
5+
Upstream Patch Reference :
6+
1. https://gitlab.gnome.org/GNOME/glib/-/commit/8d60d7dc168aee73a15eb5edeb2deaf196d96114
7+
2. https://gitlab.gnome.org/GNOME/glib/-/commit/2fa1e183613bf58d31151ecaceab91607ccc0c6d
8+
3. https://gitlab.gnome.org/GNOME/glib/-/commit/0b225e7cd80801aca6e627696064d1698aaa85e7
9+
4. https://gitlab.gnome.org/GNOME/glib/-/commit/3672764a17c26341ab8224dcaddf3e7cad699443
10+
5. https://gitlab.gnome.org/GNOME/glib/-/commit/0ffdbebd9ab3246958e14ab33bd0c65b6f05fd13
11+
12+
---
13+
glib/gdatetime.c | 48 ++++++++++++++++++++++++++++--------------------
14+
1 file changed, 28 insertions(+), 20 deletions(-)
15+
16+
diff --git a/glib/gdatetime.c b/glib/gdatetime.c
17+
index 2640e3b..a28e55d 100644
18+
--- a/glib/gdatetime.c
19+
+++ b/glib/gdatetime.c
20+
@@ -1346,12 +1346,16 @@ parse_iso8601_date (const gchar *text, gsize length,
21+
return FALSE;
22+
}
23+
24+
+/* Value returned in tz_offset is valid if and only if the function return value
25+
+ * is non-NULL. */
26+
static GTimeZone *
27+
-parse_iso8601_timezone (const gchar *text, gsize length, gssize *tz_offset)
28+
+parse_iso8601_timezone (const gchar *text, gsize length, size_t *tz_offset)
29+
{
30+
- gint i, tz_length, offset_hours, offset_minutes;
31+
+ size_t tz_length;
32+
+ gint offset_hours, offset_minutes;
33+
gint offset_sign = 1;
34+
GTimeZone *tz;
35+
+ const char *tz_start;
36+
37+
/* UTC uses Z suffix */
38+
if (length > 0 && text[length - 1] == 'Z')
39+
@@ -1361,42 +1365,42 @@ parse_iso8601_timezone (const gchar *text, gsize length, gssize *tz_offset)
40+
}
41+
42+
/* Look for '+' or '-' of offset */
43+
- for (i = length - 1; i >= 0; i--)
44+
- if (text[i] == '+' || text[i] == '-')
45+
+ for (tz_length = 1; tz_length <= length; tz_length++)
46+
+ if (text[length - tz_length] == '+' || text[length - tz_length] == '-')
47+
{
48+
- offset_sign = text[i] == '-' ? -1 : 1;
49+
+ offset_sign = text[length - tz_length] == '-' ? -1 : 1;
50+
break;
51+
}
52+
- if (i < 0)
53+
+ if (tz_length > length)
54+
return NULL;
55+
- tz_length = length - i;
56+
+ tz_start = text + length - tz_length;
57+
58+
/* +hh:mm or -hh:mm */
59+
- if (tz_length == 6 && text[i+3] == ':')
60+
+ if (tz_length == 6 && tz_start[3] == ':')
61+
{
62+
- if (!get_iso8601_int (text + i + 1, 2, &offset_hours) ||
63+
- !get_iso8601_int (text + i + 4, 2, &offset_minutes))
64+
+ if (!get_iso8601_int (tz_start + 1, 2, &offset_hours) ||
65+
+ !get_iso8601_int (tz_start + 4, 2, &offset_minutes))
66+
return NULL;
67+
}
68+
/* +hhmm or -hhmm */
69+
else if (tz_length == 5)
70+
{
71+
- if (!get_iso8601_int (text + i + 1, 2, &offset_hours) ||
72+
- !get_iso8601_int (text + i + 3, 2, &offset_minutes))
73+
+ if (!get_iso8601_int (tz_start + 1, 2, &offset_hours) ||
74+
+ !get_iso8601_int (tz_start + 3, 2, &offset_minutes))
75+
return NULL;
76+
}
77+
/* +hh or -hh */
78+
else if (tz_length == 3)
79+
{
80+
- if (!get_iso8601_int (text + i + 1, 2, &offset_hours))
81+
+ if (!get_iso8601_int (tz_start + 1, 2, &offset_hours))
82+
return NULL;
83+
offset_minutes = 0;
84+
}
85+
else
86+
return NULL;
87+
88+
- *tz_offset = i;
89+
- tz = g_time_zone_new_identifier (text + i);
90+
+ *tz_offset = tz_start - text;
91+
+ tz = g_time_zone_new_identifier (tz_start);
92+
93+
/* Double-check that the GTimeZone matches our interpretation of the timezone.
94+
* This can fail because our interpretation is less strict than (for example)
95+
@@ -1415,11 +1419,11 @@ static gboolean
96+
parse_iso8601_time (const gchar *text, gsize length,
97+
gint *hour, gint *minute, gdouble *seconds, GTimeZone **tz)
98+
{
99+
- gssize tz_offset = -1;
100+
+ size_t tz_offset = 0;
101+
102+
/* Check for timezone suffix */
103+
*tz = parse_iso8601_timezone (text, length, &tz_offset);
104+
- if (tz_offset >= 0)
105+
+ if (*tz != NULL)
106+
length = tz_offset;
107+
108+
/* hh:mm:ss(.sss) */
109+
@@ -1497,7 +1501,8 @@ parse_iso8601_time (const gchar *text, gsize length,
110+
GDateTime *
111+
g_date_time_new_from_iso8601 (const gchar *text, GTimeZone *default_tz)
112+
{
113+
- gint length, date_length = -1;
114+
+ size_t length, date_length = 0;
115+
+ gboolean date_length_set = FALSE;
116+
gint hour = 0, minute = 0;
117+
gdouble seconds = 0.0;
118+
GTimeZone *tz = NULL;
119+
@@ -1508,11 +1513,14 @@ g_date_time_new_from_iso8601 (const gchar *text, GTimeZone *default_tz)
120+
/* Count length of string and find date / time separator ('T', 't', or ' ') */
121+
for (length = 0; text[length] != '\0'; length++)
122+
{
123+
- if (date_length < 0 && (text[length] == 'T' || text[length] == 't' || text[length] == ' '))
124+
+ if (!date_length_set && (text[length] == 'T' || text[length] == 't' || text[length] == ' '))
125+
+ {
126+
date_length = length;
127+
+ date_length_set = TRUE;
128+
+ }
129+
}
130+
131+
- if (date_length < 0)
132+
+ if (!date_length_set)
133+
return NULL;
134+
135+
if (!parse_iso8601_time (text + date_length + 1, length - (date_length + 1),
136+
--
137+
2.45.3
138+

SPECS/glib/glib.spec

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Summary: Low-level libraries useful for providing data structure handling for C.
33
Name: glib
44
Version: 2.71.0
5-
Release: 4%{?dist}
5+
Release: 5%{?dist}
66
License: LGPLv2+
77
Vendor: Microsoft Corporation
88
Distribution: Mariner
@@ -13,6 +13,7 @@ Patch0: CVE-2024-52533.patch
1313
Patch1: CVE-2023-29499.patch
1414
# This patch fixes 2 CVEs - CVE-2023-32643 and CVE-2023-32636
1515
Patch2: CVE-2023-32643-CVE-2023-32636.patch
16+
Patch3: CVE-2025-3360.patch
1617
BuildRequires: cmake
1718
BuildRequires: gtk-doc
1819
BuildRequires: libffi-devel
@@ -126,6 +127,9 @@ touch %{buildroot}%{_libdir}/gio/modules/giomodule.cache
126127
%doc %{_datadir}/gtk-doc/html/*
127128

128129
%changelog
130+
* Wed Apr 16 2025 Archana Shettigar <[email protected]> - 2.71.0-5
131+
- Patch CVE-2025-3360
132+
129133
* Thu Feb 13 2025 Ankita Pareek <[email protected]> - 2.71.0-4
130134
- Address CVE-2023-29499, CVE-2023-32643 and CVE-2023-32636
131135

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -199,7 +199,7 @@ libxml2-devel-2.10.4-6.cm2.aarch64.rpm
199199
docbook-dtd-xml-4.5-11.cm2.noarch.rpm
200200
docbook-style-xsl-1.79.1-14.cm2.noarch.rpm
201201
libsepol-3.2-2.cm2.aarch64.rpm
202-
glib-2.71.0-4.cm2.aarch64.rpm
202+
glib-2.71.0-5.cm2.aarch64.rpm
203203
libltdl-2.4.6-8.cm2.aarch64.rpm
204204
libltdl-devel-2.4.6-8.cm2.aarch64.rpm
205205
pcre-8.45-2.cm2.aarch64.rpm

toolkit/resources/manifests/package/pkggen_core_x86_64.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -199,7 +199,7 @@ libxml2-devel-2.10.4-6.cm2.x86_64.rpm
199199
docbook-dtd-xml-4.5-11.cm2.noarch.rpm
200200
docbook-style-xsl-1.79.1-14.cm2.noarch.rpm
201201
libsepol-3.2-2.cm2.x86_64.rpm
202-
glib-2.71.0-4.cm2.x86_64.rpm
202+
glib-2.71.0-5.cm2.x86_64.rpm
203203
libltdl-2.4.6-8.cm2.x86_64.rpm
204204
libltdl-devel-2.4.6-8.cm2.x86_64.rpm
205205
pcre-8.45-2.cm2.x86_64.rpm

toolkit/resources/manifests/package/toolchain_aarch64.txt

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -101,11 +101,11 @@ gdbm-lang-1.21-1.cm2.aarch64.rpm
101101
gettext-0.21-3.cm2.aarch64.rpm
102102
gettext-debuginfo-0.21-3.cm2.aarch64.rpm
103103
gfortran-11.2.0-8.cm2.aarch64.rpm
104-
glib-2.71.0-4.cm2.aarch64.rpm
105-
glib-debuginfo-2.71.0-4.cm2.aarch64.rpm
106-
glib-devel-2.71.0-4.cm2.aarch64.rpm
107-
glib-doc-2.71.0-4.cm2.noarch.rpm
108-
glib-schemas-2.71.0-4.cm2.aarch64.rpm
104+
glib-2.71.0-5.cm2.aarch64.rpm
105+
glib-debuginfo-2.71.0-5.cm2.aarch64.rpm
106+
glib-devel-2.71.0-5.cm2.aarch64.rpm
107+
glib-doc-2.71.0-5.cm2.noarch.rpm
108+
glib-schemas-2.71.0-5.cm2.aarch64.rpm
109109
glibc-2.35-7.cm2.aarch64.rpm
110110
glibc-debuginfo-2.35-7.cm2.aarch64.rpm
111111
glibc-devel-2.35-7.cm2.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -106,11 +106,11 @@ gdbm-lang-1.21-1.cm2.x86_64.rpm
106106
gettext-0.21-3.cm2.x86_64.rpm
107107
gettext-debuginfo-0.21-3.cm2.x86_64.rpm
108108
gfortran-11.2.0-8.cm2.x86_64.rpm
109-
glib-2.71.0-4.cm2.x86_64.rpm
110-
glib-debuginfo-2.71.0-4.cm2.x86_64.rpm
111-
glib-devel-2.71.0-4.cm2.x86_64.rpm
112-
glib-doc-2.71.0-4.cm2.noarch.rpm
113-
glib-schemas-2.71.0-4.cm2.x86_64.rpm
109+
glib-2.71.0-5.cm2.x86_64.rpm
110+
glib-debuginfo-2.71.0-5.cm2.x86_64.rpm
111+
glib-devel-2.71.0-5.cm2.x86_64.rpm
112+
glib-doc-2.71.0-5.cm2.noarch.rpm
113+
glib-schemas-2.71.0-5.cm2.x86_64.rpm
114114
glibc-2.35-7.cm2.x86_64.rpm
115115
glibc-debuginfo-2.35-7.cm2.x86_64.rpm
116116
glibc-devel-2.35-7.cm2.x86_64.rpm

0 commit comments

Comments
 (0)