From c4a9a331b8a120cb2b44cab4bf93e331e8d87dea Mon Sep 17 00:00:00 2001 From: Philip Withnall Date: Tue, 25 Nov 2025 19:02:56 +0000 Subject: [PATCH] gvariant-parser: Fix potential integer overflow parsing (byte)strings The termination condition for parsing string and bytestring literals in GVariant text format input was subject to an integer overflow for input string (or bytestring) literals longer than `INT_MAX`. Fix that by counting as a `size_t` rather than as an `int`. The counter can never correctly be negative. Spotted by treeplus. Thanks to the Sovereign Tech Resilience programme from the Sovereign Tech Agency. ID: #YWH-PGM9867-145 CVE: CVE-2025-14087 Upstream: https://gitlab.gnome.org/GNOME/glib/-/commit/3e72fe0fbb32c18a66486c4da8bc851f656af287 Signed-off-by: Philip Withnall Fixes: #3834 (cherry picked from commit 3e72fe0fbb32c18a66486c4da8bc851f656af287) Signed-off-by: Peter Korsgaard --- glib/gvariant-parser.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/glib/gvariant-parser.c b/glib/gvariant-parser.c index 8bd16766c..6331e0c95 100644 --- a/glib/gvariant-parser.c +++ b/glib/gvariant-parser.c @@ -597,7 +597,7 @@ ast_resolve (AST *ast, { GVariant *value; gchar *pattern; - gint i, j = 0; + size_t i, j = 0; pattern = ast_get_pattern (ast, error); @@ -1621,9 +1621,9 @@ string_free (AST *ast) * No leading/trailing space allowed. */ static gboolean unicode_unescape (const gchar *src, - gint *src_ofs, + size_t *src_ofs, gchar *dest, - gint *dest_ofs, + size_t *dest_ofs, gsize length, SourceRef *ref, GError **error) @@ -1684,7 +1684,7 @@ string_parse (TokenStream *stream, gsize length; gchar quote; gchar *str; - gint i, j; + size_t i, j; token_stream_start_ref (stream, &ref); token = token_stream_get (stream); @@ -1814,7 +1814,7 @@ bytestring_parse (TokenStream *stream, gsize length; gchar quote; gchar *str; - gint i, j; + size_t i, j; token_stream_start_ref (stream, &ref); token = token_stream_get (stream); -- 2.43.0