From: Peter Marko <[email protected]> Pick patch referencing this CVE.
Signed-off-by: Peter Marko <[email protected]> --- .../glib-2.0/files/CVE-2026-16118.patch | 48 +++++++++++++++++++ meta/recipes-core/glib-2.0/glib.inc | 1 + 2 files changed, 49 insertions(+) create mode 100644 meta/recipes-core/glib-2.0/files/CVE-2026-16118.patch diff --git a/meta/recipes-core/glib-2.0/files/CVE-2026-16118.patch b/meta/recipes-core/glib-2.0/files/CVE-2026-16118.patch new file mode 100644 index 0000000000..72a387079e --- /dev/null +++ b/meta/recipes-core/glib-2.0/files/CVE-2026-16118.patch @@ -0,0 +1,48 @@ +From ca75aff83af9875ea2ad2bfbe48a85dfd99c2ce5 Mon Sep 17 00:00:00 2001 +From: Kashyap Ekbote <[email protected]> +Date: Wed, 5 Aug 2026 20:50:10 +0530 +Subject: [PATCH] Fix CVE-2026-16118: heap-buffer-overflow in xdgmimemagic.c + +Fix out-of-bounds write in the byte-swap routine of +_xdg_mime_magic_parse_magic_line(). On little-endian systems, the +write side of the swap casts the base pointer to a wider type before +adding the byte offset, causing pointer arithmetic to scale by +sizeof(type) instead of 1. With value_length=4 and word_size=2, the +loop writes 2 bytes past the allocated matchlet->value buffer at i=2. + +Parenthesize (ptr + i) before the cast so both the read and write +sides use byte offsets. + +Upstream: https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41 + +CVE: CVE-2026-16118 +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/ca75aff83af9875ea2ad2bfbe48a85dfd99c2ce5] +Signed-off-by: Peter Marko <[email protected]> +--- + gio/xdgmime/xdgmimemagic.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/gio/xdgmime/xdgmimemagic.c b/gio/xdgmime/xdgmimemagic.c +index 98a1274c8..fe374eb4e 100644 +--- a/gio/xdgmime/xdgmimemagic.c ++++ b/gio/xdgmime/xdgmimemagic.c +@@ -483,15 +483,15 @@ _xdg_mime_magic_parse_magic_line (FILE *magic_file, + for (i = 0; i < matchlet->value_length; i = i + matchlet->word_size) + { + if (matchlet->word_size == 2) +- *((xdg_uint16_t *) matchlet->value + i) = SWAP_BE16_TO_LE16 (*((xdg_uint16_t *) (matchlet->value + i))); ++ *((xdg_uint16_t *) (matchlet->value + i)) = SWAP_BE16_TO_LE16 (*((xdg_uint16_t *) (matchlet->value + i))); + else if (matchlet->word_size == 4) +- *((xdg_uint32_t *) matchlet->value + i) = SWAP_BE32_TO_LE32 (*((xdg_uint32_t *) (matchlet->value + i))); ++ *((xdg_uint32_t *) (matchlet->value + i)) = SWAP_BE32_TO_LE32 (*((xdg_uint32_t *) (matchlet->value + i))); + if (matchlet->mask) + { + if (matchlet->word_size == 2) +- *((xdg_uint16_t *) matchlet->mask + i) = SWAP_BE16_TO_LE16 (*((xdg_uint16_t *) (matchlet->mask + i))); ++ *((xdg_uint16_t *) (matchlet->mask + i)) = SWAP_BE16_TO_LE16 (*((xdg_uint16_t *) (matchlet->mask + i))); + else if (matchlet->word_size == 4) +- *((xdg_uint32_t *) matchlet->mask + i) = SWAP_BE32_TO_LE32 (*((xdg_uint32_t *) (matchlet->mask + i))); ++ *((xdg_uint32_t *) (matchlet->mask + i)) = SWAP_BE32_TO_LE32 (*((xdg_uint32_t *) (matchlet->mask + i))); + + } + } diff --git a/meta/recipes-core/glib-2.0/glib.inc b/meta/recipes-core/glib-2.0/glib.inc index 7e7725f9bd..aec875a3df 100644 --- a/meta/recipes-core/glib-2.0/glib.inc +++ b/meta/recipes-core/glib-2.0/glib.inc @@ -237,6 +237,7 @@ SRC_URI += "\ file://skip-timeout.patch \ file://CVE-2026-58016-1.patch \ file://CVE-2026-58016-2.patch \ + file://CVE-2026-16118.patch \ " SRC_URI:append:class-native = " file://relocate-modules.patch \ file://0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch \
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#248567): https://lists.openembedded.org/g/openembedded-core/message/248567 Mute This Topic: https://lists.openembedded.org/mt/121907765/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
