From 31f82e22e21bae520b7228f7f57d357fb20df8a4 Mon Sep 17 00:00:00 2001 From: Philip Withnall Date: Tue, 25 Nov 2025 19:02:56 +0000 Subject: [PATCH] gvariant-parser: Fix potential integer overflow parsing (byte)strings The termination condition for parsing string and bytestring literals in GVariant text format input was subject to an integer overflow for input string (or bytestring) literals longer than `INT_MAX`. Fix that by counting as a `size_t` rather than as an `int`. The counter can never correctly be negative. Spotted by treeplus. Thanks to the Sovereign Tech Resilience programme from the Sovereign Tech Agency. ID: #YWH-PGM9867-145 Signed-off-by: Philip Withnall Fixes: #3834 CVE: CVE-2025-14087 Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/31f82e22e21bae520b7228f7f57d357fb20df8a4] Signed-off-by: Peter Marko --- glib/gvariant-parser.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/glib/gvariant-parser.c b/glib/gvariant-parser.c index 2f1d3db9f..2d6e9856f 100644 --- a/glib/gvariant-parser.c +++ b/glib/gvariant-parser.c @@ -594,7 +594,7 @@ ast_resolve (AST *ast, { GVariant *value; gchar *pattern; - gint i, j = 0; + size_t i, j = 0; pattern = ast_get_pattern (ast, error); @@ -1555,9 +1555,9 @@ string_free (AST *ast) * No leading/trailing space allowed. */ static gboolean unicode_unescape (const gchar *src, - gint *src_ofs, + size_t *src_ofs, gchar *dest, - gint *dest_ofs, + size_t *dest_ofs, gsize length, SourceRef *ref, GError **error) @@ -1618,7 +1618,7 @@ string_parse (TokenStream *stream, gsize length; gchar quote; gchar *str; - gint i, j; + size_t i, j; token_stream_start_ref (stream, &ref); token = token_stream_get (stream); @@ -1748,7 +1748,7 @@ bytestring_parse (TokenStream *stream, gsize length; gchar quote; gchar *str; - gint i, j; + size_t i, j; token_stream_start_ref (stream, &ref); token = token_stream_get (stream);