From 25429bd0b22222d6986d000d62b44eebf490837d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marco=20Trevisan=20=28Trevi=C3=B1o=29?= Date: Wed, 21 Jan 2026 20:09:44 +0100 Subject: [PATCH] gbase64: Ensure that the out value is within allocated size We do not want to deference or write to it Related to: #3870 CVE: CVE-2026-1484 Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/25429bd0b22222d6986d000d62b44eebf490837d] Signed-off-by: Peter Marko --- glib/gbase64.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/glib/gbase64.c b/glib/gbase64.c index 214b48911..0141b3b07 100644 --- a/glib/gbase64.c +++ b/glib/gbase64.c @@ -265,6 +265,7 @@ g_base64_encode (const guchar *data, gint state = 0; gint save = 0; gsize outlen; + gsize allocsize; g_return_val_if_fail (data != NULL || len == 0, NULL); @@ -272,10 +273,15 @@ g_base64_encode (const guchar *data, +1 is needed for trailing \0, also check for unlikely integer overflow */ g_return_val_if_fail (len < ((G_MAXSIZE - 1) / 4 - 1) * 3, NULL); - out = g_malloc ((len / 3 + 1) * 4 + 1); + allocsize = (len / 3 + 1) * 4 + 1; + out = g_malloc (allocsize); outlen = g_base64_encode_step (data, len, FALSE, out, &state, &save); + g_assert (outlen <= allocsize); + outlen += g_base64_encode_close (FALSE, out + outlen, &state, &save); + g_assert (outlen <= allocsize); + out[outlen] = '\0'; return (gchar *) out;