|
| 1 | +From 407e37b2f0464eee439866e9c15d626cfb06a072 Mon Sep 17 00:00:00 2001 |
| 2 | +From: archana25-ms < [email protected]> |
| 3 | +Date: Wed, 16 Apr 2025 05:26:51 +0000 |
| 4 | +Subject: [PATCH] Address CVE-2025-3360 |
| 5 | +Upstream Patch Reference : |
| 6 | +1. https://gitlab.gnome.org/GNOME/glib/-/commit/8d60d7dc168aee73a15eb5edeb2deaf196d96114 |
| 7 | +2. https://gitlab.gnome.org/GNOME/glib/-/commit/2fa1e183613bf58d31151ecaceab91607ccc0c6d |
| 8 | +3. https://gitlab.gnome.org/GNOME/glib/-/commit/0b225e7cd80801aca6e627696064d1698aaa85e7 |
| 9 | +4. https://gitlab.gnome.org/GNOME/glib/-/commit/3672764a17c26341ab8224dcaddf3e7cad699443 |
| 10 | +5. https://gitlab.gnome.org/GNOME/glib/-/commit/0ffdbebd9ab3246958e14ab33bd0c65b6f05fd13 |
| 11 | + |
| 12 | +--- |
| 13 | + glib/gdatetime.c | 48 ++++++++++++++++++++++++++++-------------------- |
| 14 | + 1 file changed, 28 insertions(+), 20 deletions(-) |
| 15 | + |
| 16 | +diff --git a/glib/gdatetime.c b/glib/gdatetime.c |
| 17 | +index 2640e3b..a28e55d 100644 |
| 18 | +--- a/glib/gdatetime.c |
| 19 | ++++ b/glib/gdatetime.c |
| 20 | +@@ -1346,12 +1346,16 @@ parse_iso8601_date (const gchar *text, gsize length, |
| 21 | + return FALSE; |
| 22 | + } |
| 23 | + |
| 24 | ++/* Value returned in tz_offset is valid if and only if the function return value |
| 25 | ++ * is non-NULL. */ |
| 26 | + static GTimeZone * |
| 27 | +-parse_iso8601_timezone (const gchar *text, gsize length, gssize *tz_offset) |
| 28 | ++parse_iso8601_timezone (const gchar *text, gsize length, size_t *tz_offset) |
| 29 | + { |
| 30 | +- gint i, tz_length, offset_hours, offset_minutes; |
| 31 | ++ size_t tz_length; |
| 32 | ++ gint offset_hours, offset_minutes; |
| 33 | + gint offset_sign = 1; |
| 34 | + GTimeZone *tz; |
| 35 | ++ const char *tz_start; |
| 36 | + |
| 37 | + /* UTC uses Z suffix */ |
| 38 | + if (length > 0 && text[length - 1] == 'Z') |
| 39 | +@@ -1361,42 +1365,42 @@ parse_iso8601_timezone (const gchar *text, gsize length, gssize *tz_offset) |
| 40 | + } |
| 41 | + |
| 42 | + /* Look for '+' or '-' of offset */ |
| 43 | +- for (i = length - 1; i >= 0; i--) |
| 44 | +- if (text[i] == '+' || text[i] == '-') |
| 45 | ++ for (tz_length = 1; tz_length <= length; tz_length++) |
| 46 | ++ if (text[length - tz_length] == '+' || text[length - tz_length] == '-') |
| 47 | + { |
| 48 | +- offset_sign = text[i] == '-' ? -1 : 1; |
| 49 | ++ offset_sign = text[length - tz_length] == '-' ? -1 : 1; |
| 50 | + break; |
| 51 | + } |
| 52 | +- if (i < 0) |
| 53 | ++ if (tz_length > length) |
| 54 | + return NULL; |
| 55 | +- tz_length = length - i; |
| 56 | ++ tz_start = text + length - tz_length; |
| 57 | + |
| 58 | + /* +hh:mm or -hh:mm */ |
| 59 | +- if (tz_length == 6 && text[i+3] == ':') |
| 60 | ++ if (tz_length == 6 && tz_start[3] == ':') |
| 61 | + { |
| 62 | +- if (!get_iso8601_int (text + i + 1, 2, &offset_hours) || |
| 63 | +- !get_iso8601_int (text + i + 4, 2, &offset_minutes)) |
| 64 | ++ if (!get_iso8601_int (tz_start + 1, 2, &offset_hours) || |
| 65 | ++ !get_iso8601_int (tz_start + 4, 2, &offset_minutes)) |
| 66 | + return NULL; |
| 67 | + } |
| 68 | + /* +hhmm or -hhmm */ |
| 69 | + else if (tz_length == 5) |
| 70 | + { |
| 71 | +- if (!get_iso8601_int (text + i + 1, 2, &offset_hours) || |
| 72 | +- !get_iso8601_int (text + i + 3, 2, &offset_minutes)) |
| 73 | ++ if (!get_iso8601_int (tz_start + 1, 2, &offset_hours) || |
| 74 | ++ !get_iso8601_int (tz_start + 3, 2, &offset_minutes)) |
| 75 | + return NULL; |
| 76 | + } |
| 77 | + /* +hh or -hh */ |
| 78 | + else if (tz_length == 3) |
| 79 | + { |
| 80 | +- if (!get_iso8601_int (text + i + 1, 2, &offset_hours)) |
| 81 | ++ if (!get_iso8601_int (tz_start + 1, 2, &offset_hours)) |
| 82 | + return NULL; |
| 83 | + offset_minutes = 0; |
| 84 | + } |
| 85 | + else |
| 86 | + return NULL; |
| 87 | + |
| 88 | +- *tz_offset = i; |
| 89 | +- tz = g_time_zone_new_identifier (text + i); |
| 90 | ++ *tz_offset = tz_start - text; |
| 91 | ++ tz = g_time_zone_new_identifier (tz_start); |
| 92 | + |
| 93 | + /* Double-check that the GTimeZone matches our interpretation of the timezone. |
| 94 | + * This can fail because our interpretation is less strict than (for example) |
| 95 | +@@ -1415,11 +1419,11 @@ static gboolean |
| 96 | + parse_iso8601_time (const gchar *text, gsize length, |
| 97 | + gint *hour, gint *minute, gdouble *seconds, GTimeZone **tz) |
| 98 | + { |
| 99 | +- gssize tz_offset = -1; |
| 100 | ++ size_t tz_offset = 0; |
| 101 | + |
| 102 | + /* Check for timezone suffix */ |
| 103 | + *tz = parse_iso8601_timezone (text, length, &tz_offset); |
| 104 | +- if (tz_offset >= 0) |
| 105 | ++ if (*tz != NULL) |
| 106 | + length = tz_offset; |
| 107 | + |
| 108 | + /* hh:mm:ss(.sss) */ |
| 109 | +@@ -1497,7 +1501,8 @@ parse_iso8601_time (const gchar *text, gsize length, |
| 110 | + GDateTime * |
| 111 | + g_date_time_new_from_iso8601 (const gchar *text, GTimeZone *default_tz) |
| 112 | + { |
| 113 | +- gint length, date_length = -1; |
| 114 | ++ size_t length, date_length = 0; |
| 115 | ++ gboolean date_length_set = FALSE; |
| 116 | + gint hour = 0, minute = 0; |
| 117 | + gdouble seconds = 0.0; |
| 118 | + GTimeZone *tz = NULL; |
| 119 | +@@ -1508,11 +1513,14 @@ g_date_time_new_from_iso8601 (const gchar *text, GTimeZone *default_tz) |
| 120 | + /* Count length of string and find date / time separator ('T', 't', or ' ') */ |
| 121 | + for (length = 0; text[length] != '\0'; length++) |
| 122 | + { |
| 123 | +- if (date_length < 0 && (text[length] == 'T' || text[length] == 't' || text[length] == ' ')) |
| 124 | ++ if (!date_length_set && (text[length] == 'T' || text[length] == 't' || text[length] == ' ')) |
| 125 | ++ { |
| 126 | + date_length = length; |
| 127 | ++ date_length_set = TRUE; |
| 128 | ++ } |
| 129 | + } |
| 130 | + |
| 131 | +- if (date_length < 0) |
| 132 | ++ if (!date_length_set) |
| 133 | + return NULL; |
| 134 | + |
| 135 | + if (!parse_iso8601_time (text + date_length + 1, length - (date_length + 1), |
| 136 | +-- |
| 137 | +2.45.3 |
| 138 | + |
0 commit comments