From 5ba0ed9ab2c28294713bdc56a8744ff0a446b59c Mon Sep 17 00:00:00 2001 From: Marco Trevisan Date: Fri, 23 Jan 2026 18:48:30 +0100 Subject: [PATCH] gbase64: Use gsize to prevent potential overflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both g_base64_encode_step() and g_base64_encode_close() return gsize values, but these are summed to an int value. If the sum of these returned values is bigger than MAXINT, we overflow while doing the null byte write. Spotted by treeplus. Thanks to the Sovereign Tech Resilience programme from the Sovereign Tech Agency. ID: #YWH-PGM9867-168 Closes: #3870 (cherry picked from commit 6845f7776982849a2be1d8c9b0495e389092bff2) Co-authored-by: Marco Trevisan (Treviño) CVE: CVE-2026-1484 Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/5ba0ed9ab2c28294713bdc56a8744ff0a446b59c] Signed-off-by: Peter Marko --- glib/gbase64.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/glib/gbase64.c b/glib/gbase64.c index 2ea4a4ef4..214b48911 100644 --- a/glib/gbase64.c +++ b/glib/gbase64.c @@ -262,8 +262,9 @@ g_base64_encode (const guchar *data, gsize len) { gchar *out; - gint state = 0, outlen; + gint state = 0; gint save = 0; + gsize outlen; g_return_val_if_fail (data != NULL || len == 0, NULL);