From 662aa569efa65eaa4672ab0671eb8533a354cd89 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marco=20Trevisan=20=28Trevi=C3=B1o=29?= Date: Wed, 21 Jan 2026 22:00:17 +0100 Subject: [PATCH] guniprop: Use size_t for output_marks length The input string length may overflow, and this would lead to wrong behavior and invalid writes. Spotted by treeplus. Thanks to the Sovereign Tech Resilience programme from the Sovereign Tech Agency. ID: #YWH-PGM9867-171 Closes: #3872 CVE: CVE-2026-1489 Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/662aa569efa65eaa4672ab0671eb8533a354cd89] Signed-off-by: Peter Marko --- glib/guniprop.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/glib/guniprop.c b/glib/guniprop.c index fe0033fd6..1a0cc6408 100644 --- a/glib/guniprop.c +++ b/glib/guniprop.c @@ -753,13 +753,13 @@ get_locale_type (void) return LOCALE_NORMAL; } -static gint +static size_t output_marks (const char **p_inout, char *out_buffer, gboolean remove_dot) { const char *p = *p_inout; - gint len = 0; + size_t len = 0; while (*p) {