mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-15 15:49:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

glib-2.0: fix CVE-2026-58015

Browse Source 
This patch applies the upstream glib-2-88 stable backport chain for
CVE-2026-58015. The issue is in the D-Bus SHA-1 authentication
mechanism, where a malicious peer could provide an unchecked cookie
context and cause the client to access unintended files while resolving
the cookie challenge.

Backport the upstream GLib fix chain from the glib-2-88 stable branch:
- db9c8fae398b validates cookie_context before keyring lookup. This is
the primary security fix for CVE-2026-58015 [1].
- c0531125344b tightens cookie ID parsing so empty, negative, and
out-of-range values are rejected. This hardens the same SHA-1 cookie
challenge parser and is covered by the upstream regression test [2].
- 060aea67de75 exposes the private client reject-reason vfunc. This is
test-support plumbing required by the upstream regression test [3].
- 091930196229 adds the upstream regression test for SHA-1 cookie
challenge parsing [4].

Add dbus-native to PACKAGECONFIG[tests] so Meson can find dbus-daemon
when building the new installed D-Bus regression test for ptest. This is
kept as a native-only test dependency to avoid adding a target dbus
dependency to glib.

[1] db9c8fae39
[2] c053112534
[3] 060aea67de
[4] 0919301962
[5] https://nvd.nist.gov/vuln/detail/CVE-2026-58015

(From OE-Core rev: b6b82e3c1442b658bd4c1689e09792c9a3a96947)

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Deepak Rathore
2026-08-13 14:27:00 +05:30
committed by Richard Purdie
parent 8cf593c04e
commit 1d390a4e04
6 changed files with 577 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

97
meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-58015_p1.patch Normal file
View File

@@ -0,0 +1,97 @@
From 1d0d0dc891399e8572a6c96b116149d076e2de28 Mon Sep 17 00:00:00 2001
From: Philip Withnall <pwithnall@gnome.org>
Date: Tue, 28 Apr 2026 15:47:30 +0100
Subject: [PATCH 1/4] gdbusauthmechanismsha1: Validate cookie context
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Without validation, the server could send a malicious context which
contains path traversal characters, allowing it to exfiltrate a SHA-1
hashed copy of arbitrary data from the client’s file system.
To exploit this successfully would require the client to choose to
connect peer-to-peer to a malicious D-Bus server and to choose the SHA-1
authentication mechanism in preference to all the other mechanisms. This
is vanishingly unlikely.
CVE: CVE-2026-58015
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/db9c8fae398b0c457e660ce63dd5afec8993046a]
Backport Changes:
- Added <stdint.h> include because the target branch does not otherwise
expose uint8_t used by the upstream validation code during native builds.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Fixes: #3931
(cherry picked from commit db9c8fae398b0c457e660ce63dd5afec8993046a)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
gio/gdbusauthmechanismsha1.c | 37 ++++++++++++++++++++++++++++++++++++
1 file changed, 37 insertions(+)
diff --git a/gio/gdbusauthmechanismsha1.c b/gio/gdbusauthmechanismsha1.c
index c8aa08977..7d8fc1922 100644
--- a/gio/gdbusauthmechanismsha1.c
+++ b/gio/gdbusauthmechanismsha1.c
@@ -22,6 +22,7 @@
#include "config.h"
+#include <stdint.h>
#include <string.h>
#include <fcntl.h>
#include <errno.h>
@@ -1198,6 +1199,34 @@ mechanism_client_initiate (GDBusAuthMechanism *mechanism,
return initial_response;
}
+/* Context names must be valid ASCII, nonzero length, and may not contain the
+ * characters slash ("/"), backslash ("\"), space (" "), newline ("\n"),
+ * carriage return ("\r"), tab ("\t"), or period (".").
+ *
+ * See https://dbus.freedesktop.org/doc/dbus-specification.html#auth-mechanisms-sha */
+static gboolean
+validate_cookie_context (const char *cookie_context)
+{
+ size_t i = 0;
+
+ g_return_val_if_fail (cookie_context != NULL, FALSE);
+
+ for (i = 0; cookie_context[i] != '\0'; i++)
+ {
+ if ((uint8_t) cookie_context[i] >= 128 ||
+ cookie_context[i] == '/' ||
+ cookie_context[i] == '\\' ||
+ cookie_context[i] == ' ' ||
+ cookie_context[i] == '\n' ||
+ cookie_context[i] == '\r' ||
+ cookie_context[i] == '\t' ||
+ cookie_context[i] == '.')
+ return FALSE;
+ }
+
+ return (i > 0);
+}
+
static void
mechanism_client_data_receive (GDBusAuthMechanism *mechanism,
const gchar *data,
@@ -1232,6 +1261,14 @@ mechanism_client_data_receive (GDBusAuthMechanism *mechanism,
}
cookie_context = tokens[0];
+ if (!validate_cookie_context (tokens[0]))
+ {
+ g_free (m->priv->reject_reason);
+ m->priv->reject_reason = g_strdup_printf ("Malformed cookie_context '%s'", tokens[0]);
+ m->priv->state = G_DBUS_AUTH_MECHANISM_STATE_REJECTED;
+ goto out;
+ }
+
cookie_id = g_ascii_strtoll (tokens[1], &endp, 10);
if (*endp != '\0')
{
--
2.35.6

55
meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-58015_p2.patch Normal file
View File

@@ -0,0 +1,55 @@
From a94b2df7e2bc5f49661e53c2781ce99ae48d18aa Mon Sep 17 00:00:00 2001
From: Philip Withnall <pwithnall@gnome.org>
Date: Tue, 28 Apr 2026 15:49:54 +0100
Subject: [PATCH 2/4] gdbusauthmechanismsha1: Improve validation of cookie ID
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The D-Bus specification says the cookie ID has to be non-negative, but
we weren’t checking that (or checking that it was non-empty).
CVE: CVE-2026-58015
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/c0531125344bb25fd66ffb7435ed6c285de09aeb]
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
(cherry picked from commit c0531125344bb25fd66ffb7435ed6c285de09aeb)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
gio/gdbusauthmechanismsha1.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/gio/gdbusauthmechanismsha1.c b/gio/gdbusauthmechanismsha1.c
index 7d8fc1922..e753d139d 100644
--- a/gio/gdbusauthmechanismsha1.c
+++ b/gio/gdbusauthmechanismsha1.c
@@ -1235,7 +1235,7 @@ mechanism_client_data_receive (GDBusAuthMechanism *mechanism,
GDBusAuthMechanismSha1 *m = G_DBUS_AUTH_MECHANISM_SHA1 (mechanism);
gchar **tokens;
const gchar *cookie_context;
- guint cookie_id;
+ int64_t cookie_id;
const gchar *server_challenge;
gchar *client_challenge;
gchar *endp;
@@ -1270,7 +1270,7 @@ mechanism_client_data_receive (GDBusAuthMechanism *mechanism,
}
cookie_id = g_ascii_strtoll (tokens[1], &endp, 10);
- if (*endp != '\0')
+ if (*endp != '\0' || endp == tokens[1] || cookie_id < 0 || cookie_id > UINT32_MAX)
{
g_free (m->priv->reject_reason);
m->priv->reject_reason = g_strdup_printf ("Malformed cookie_id '%s'", tokens[1]);
@@ -1280,7 +1280,7 @@ mechanism_client_data_receive (GDBusAuthMechanism *mechanism,
server_challenge = tokens[2];
error = NULL;
- cookie = keyring_lookup_entry (cookie_context, cookie_id, &error);
+ cookie = keyring_lookup_entry (cookie_context, (unsigned int) cookie_id, &error);
if (cookie == NULL)
{
g_free (m->priv->reject_reason);
--
2.35.6

198
meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-58015_p3.patch Normal file
View File

@@ -0,0 +1,198 @@
From 99c7abffbd1d549f6c625de6f2028efcdeea5c49 Mon Sep 17 00:00:00 2001
From: Philip Withnall <pwithnall@gnome.org>
Date: Tue, 28 Apr 2026 15:51:00 +0100
Subject: [PATCH 3/4] gdbusauthmechanism: Expose client reject reason as a new
vfunc
We can do this because `gdbusauthmechanism.h` is a private header.
Hook it up to the existing `reject_reason` code in each
`GDBusAuthMechanism` implementation, as all three implementations
currently intermingle reject reasons from the server and client code, so
there would currently be no benefit to having a separate server and
client implementation of `*_get_reject_reason()`.
This new private API will be used in a new unit test in the following
commit.
CVE: CVE-2026-58015
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/060aea67de7517d531b8fe2cdc07aa1a00ddeb22]
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
(cherry picked from commit 060aea67de7517d531b8fe2cdc07aa1a00ddeb22)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
gio/gdbusauthmechanism.c | 7 +++++++
gio/gdbusauthmechanism.h | 2 ++
gio/gdbusauthmechanismanon.c | 8 ++++----
gio/gdbusauthmechanismexternal.c | 8 ++++----
gio/gdbusauthmechanismsha1.c | 8 ++++----
5 files changed, 21 insertions(+), 12 deletions(-)
diff --git a/gio/gdbusauthmechanism.c b/gio/gdbusauthmechanism.c
index 6e494dbd9..0d4ef4389 100644
--- a/gio/gdbusauthmechanism.c
+++ b/gio/gdbusauthmechanism.c
@@ -328,6 +328,13 @@ _g_dbus_auth_mechanism_client_data_send (GDBusAuthMechanism *mechanism,
return G_DBUS_AUTH_MECHANISM_GET_CLASS (mechanism)->client_data_send (mechanism, out_data_len);
}
+gchar *
+_g_dbus_auth_mechanism_client_get_reject_reason (GDBusAuthMechanism *mechanism)
+{
+ g_return_val_if_fail (G_IS_DBUS_AUTH_MECHANISM (mechanism), NULL);
+ return G_DBUS_AUTH_MECHANISM_GET_CLASS (mechanism)->client_get_reject_reason (mechanism);
+}
+
void
_g_dbus_auth_mechanism_client_shutdown (GDBusAuthMechanism *mechanism)
{
diff --git a/gio/gdbusauthmechanism.h b/gio/gdbusauthmechanism.h
index f0edd19a3..e906a47ac 100644
--- a/gio/gdbusauthmechanism.h
+++ b/gio/gdbusauthmechanism.h
@@ -100,6 +100,7 @@ struct _GDBusAuthMechanismClass
gsize data_len);
gchar *(*client_data_send) (GDBusAuthMechanism *mechanism,
gsize *out_data_len);
+ gchar *(*client_get_reject_reason) (GDBusAuthMechanism *mechanism);
void (*client_shutdown) (GDBusAuthMechanism *mechanism);
};
@@ -148,6 +149,7 @@ void _g_dbus_auth_mechanism_client_data_receive (GDBus
gsize data_len);
gchar *_g_dbus_auth_mechanism_client_data_send (GDBusAuthMechanism *mechanism,
gsize *out_data_len);
+gchar *_g_dbus_auth_mechanism_client_get_reject_reason (GDBusAuthMechanism *mechanism);
void _g_dbus_auth_mechanism_client_shutdown (GDBusAuthMechanism *mechanism);
diff --git a/gio/gdbusauthmechanismanon.c b/gio/gdbusauthmechanismanon.c
index 5f59d4a61..3d80ec15f 100644
--- a/gio/gdbusauthmechanismanon.c
+++ b/gio/gdbusauthmechanismanon.c
@@ -56,7 +56,7 @@ static void mechanism_server_data_receive (GDBusAuthMe
gsize data_len);
static gchar *mechanism_server_data_send (GDBusAuthMechanism *mechanism,
gsize *out_data_len);
-static gchar *mechanism_server_get_reject_reason (GDBusAuthMechanism *mechanism);
+static gchar *mechanism_server_or_client_get_reject_reason (GDBusAuthMechanism *mechanism);
static void mechanism_server_shutdown (GDBusAuthMechanism *mechanism);
static GDBusAuthMechanismState mechanism_client_get_state (GDBusAuthMechanism *mechanism);
static gchar *mechanism_client_initiate (GDBusAuthMechanism *mechanism,
@@ -103,12 +103,13 @@ _g_dbus_auth_mechanism_anon_class_init (GDBusAuthMechanismAnonClass *klass)
mechanism_class->server_initiate = mechanism_server_initiate;
mechanism_class->server_data_receive = mechanism_server_data_receive;
mechanism_class->server_data_send = mechanism_server_data_send;
- mechanism_class->server_get_reject_reason = mechanism_server_get_reject_reason;
+ mechanism_class->server_get_reject_reason = mechanism_server_or_client_get_reject_reason;
mechanism_class->server_shutdown = mechanism_server_shutdown;
mechanism_class->client_get_state = mechanism_client_get_state;
mechanism_class->client_initiate = mechanism_client_initiate;
mechanism_class->client_data_receive = mechanism_client_data_receive;
mechanism_class->client_data_send = mechanism_client_data_send;
+ mechanism_class->client_get_reject_reason = mechanism_server_or_client_get_reject_reason;
mechanism_class->client_shutdown = mechanism_client_shutdown;
}
@@ -222,12 +223,11 @@ mechanism_server_data_send (GDBusAuthMechanism *mechanism,
}
static gchar *
-mechanism_server_get_reject_reason (GDBusAuthMechanism *mechanism)
+mechanism_server_or_client_get_reject_reason (GDBusAuthMechanism *mechanism)
{
GDBusAuthMechanismAnon *m = G_DBUS_AUTH_MECHANISM_ANON (mechanism);
g_return_val_if_fail (G_IS_DBUS_AUTH_MECHANISM_ANON (mechanism), NULL);
- g_return_val_if_fail (m->priv->is_server && !m->priv->is_client, NULL);
g_return_val_if_fail (m->priv->state == G_DBUS_AUTH_MECHANISM_STATE_REJECTED, NULL);
/* can never end up here because we are never in the REJECTED state */
diff --git a/gio/gdbusauthmechanismexternal.c b/gio/gdbusauthmechanismexternal.c
index 6fe8b1bed..b223ead04 100644
--- a/gio/gdbusauthmechanismexternal.c
+++ b/gio/gdbusauthmechanismexternal.c
@@ -64,7 +64,7 @@ static void mechanism_server_data_receive (GDBusAuthMe
gsize data_len);
static gchar *mechanism_server_data_send (GDBusAuthMechanism *mechanism,
gsize *out_data_len);
-static gchar *mechanism_server_get_reject_reason (GDBusAuthMechanism *mechanism);
+static gchar *mechanism_server_or_client_get_reject_reason (GDBusAuthMechanism *mechanism);
static void mechanism_server_shutdown (GDBusAuthMechanism *mechanism);
static GDBusAuthMechanismState mechanism_client_get_state (GDBusAuthMechanism *mechanism);
static gchar *mechanism_client_initiate (GDBusAuthMechanism *mechanism,
@@ -111,12 +111,13 @@ _g_dbus_auth_mechanism_external_class_init (GDBusAuthMechanismExternalClass *kla
mechanism_class->server_initiate = mechanism_server_initiate;
mechanism_class->server_data_receive = mechanism_server_data_receive;
mechanism_class->server_data_send = mechanism_server_data_send;
- mechanism_class->server_get_reject_reason = mechanism_server_get_reject_reason;
+ mechanism_class->server_get_reject_reason = mechanism_server_or_client_get_reject_reason;
mechanism_class->server_shutdown = mechanism_server_shutdown;
mechanism_class->client_get_state = mechanism_client_get_state;
mechanism_class->client_initiate = mechanism_client_initiate;
mechanism_class->client_data_receive = mechanism_client_data_receive;
mechanism_class->client_data_send = mechanism_client_data_send;
+ mechanism_class->client_get_reject_reason = mechanism_server_or_client_get_reject_reason;
mechanism_class->client_shutdown = mechanism_client_shutdown;
}
@@ -321,12 +322,11 @@ mechanism_server_data_send (GDBusAuthMechanism *mechanism,
}
static gchar *
-mechanism_server_get_reject_reason (GDBusAuthMechanism *mechanism)
+mechanism_server_or_client_get_reject_reason (GDBusAuthMechanism *mechanism)
{
GDBusAuthMechanismExternal *m = G_DBUS_AUTH_MECHANISM_EXTERNAL (mechanism);
g_return_val_if_fail (G_IS_DBUS_AUTH_MECHANISM_EXTERNAL (mechanism), NULL);
- g_return_val_if_fail (m->priv->is_server && !m->priv->is_client, NULL);
g_return_val_if_fail (m->priv->state == G_DBUS_AUTH_MECHANISM_STATE_REJECTED, NULL);
/* can never end up here because we are never in the REJECTED state */
diff --git a/gio/gdbusauthmechanismsha1.c b/gio/gdbusauthmechanismsha1.c
index e753d139d..6c1682d3a 100644
--- a/gio/gdbusauthmechanismsha1.c
+++ b/gio/gdbusauthmechanismsha1.c
@@ -120,7 +120,7 @@ static void mechanism_server_data_receive (GDBusAuthMe
gsize data_len);
static gchar *mechanism_server_data_send (GDBusAuthMechanism *mechanism,
gsize *out_data_len);
-static gchar *mechanism_server_get_reject_reason (GDBusAuthMechanism *mechanism);
+static gchar *mechanism_server_or_client_get_reject_reason (GDBusAuthMechanism *mechanism);
static void mechanism_server_shutdown (GDBusAuthMechanism *mechanism);
static GDBusAuthMechanismState mechanism_client_get_state (GDBusAuthMechanism *mechanism);
static gchar *mechanism_client_initiate (GDBusAuthMechanism *mechanism,
@@ -173,12 +173,13 @@ _g_dbus_auth_mechanism_sha1_class_init (GDBusAuthMechanismSha1Class *klass)
mechanism_class->server_initiate = mechanism_server_initiate;
mechanism_class->server_data_receive = mechanism_server_data_receive;
mechanism_class->server_data_send = mechanism_server_data_send;
- mechanism_class->server_get_reject_reason = mechanism_server_get_reject_reason;
+ mechanism_class->server_get_reject_reason = mechanism_server_or_client_get_reject_reason;
mechanism_class->server_shutdown = mechanism_server_shutdown;
mechanism_class->client_get_state = mechanism_client_get_state;
mechanism_class->client_initiate = mechanism_client_initiate;
mechanism_class->client_data_receive = mechanism_client_data_receive;
mechanism_class->client_data_send = mechanism_client_data_send;
+ mechanism_class->client_get_reject_reason = mechanism_server_or_client_get_reject_reason;
mechanism_class->client_shutdown = mechanism_client_shutdown;
}
@@ -1129,12 +1130,11 @@ mechanism_server_data_send (GDBusAuthMechanism *mechanism,
}
static gchar *
-mechanism_server_get_reject_reason (GDBusAuthMechanism *mechanism)
+mechanism_server_or_client_get_reject_reason (GDBusAuthMechanism *mechanism)
{
GDBusAuthMechanismSha1 *m = G_DBUS_AUTH_MECHANISM_SHA1 (mechanism);
g_return_val_if_fail (G_IS_DBUS_AUTH_MECHANISM_SHA1 (mechanism), NULL);
- g_return_val_if_fail (m->priv->is_server && !m->priv->is_client, NULL);
g_return_val_if_fail (m->priv->state == G_DBUS_AUTH_MECHANISM_STATE_REJECTED, NULL);
return g_strdup (m->priv->reject_reason);
--
2.35.6

222
meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-58015_p4.patch Normal file
View File

@@ -0,0 +1,222 @@
From 80d2edcc14f476d0ec82dc0733964afa6e9ca74d Mon Sep 17 00:00:00 2001
From: Philip Withnall <pwithnall@gnome.org>
Date: Tue, 28 Apr 2026 15:52:53 +0100
Subject: [PATCH 4/4] tests: Add a unit test for GDBusAuthMechanismSha1 cookie
context parsing
This checks for regressions in the fixes from the previous few commits.
CVE: CVE-2026-58015
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/0919301962291a712067ee0c5d273cc392f33277]
Backport Changes:
- Replaced the literal U+1F600 test string with its UTF-8 byte escapes to
avoid the observed Patchwork mbox truncation. The test input is unchanged.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Helps: #3931
(cherry picked from commit 0919301962291a712067ee0c5d273cc392f33277)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
gio/tests/gdbus-auth-mechanism-sha1.c | 177 ++++++++++++++++++++++++++
gio/tests/meson.build | 1 +
2 files changed, 178 insertions(+)
create mode 100644 gio/tests/gdbus-auth-mechanism-sha1.c
diff --git a/gio/tests/gdbus-auth-mechanism-sha1.c b/gio/tests/gdbus-auth-mechanism-sha1.c
new file mode 100644
index 000000000..abcdb4e3e
--- /dev/null
+++ b/gio/tests/gdbus-auth-mechanism-sha1.c
@@ -0,0 +1,177 @@
+/* GLib testing framework examples and tests
+ *
+ * Copyright (C) 2026 Philip Withnall
+ *
+ * SPDX-License-Identifier: LGPL-2.1-or-later
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General
+ * Public License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ *
+ * Author: Philip Withnall <pwithnall@gnome.org>
+ */
+
+#include <locale.h>
+#include <gio/gio.h>
+
+#include <string.h>
+#include <unistd.h>
+
+#include "gdbus-tests.h"
+
+#ifdef G_OS_UNIX
+#include <gio/gunixconnection.h>
+#include <gio/gnetworkingprivate.h>
+#include <gio/gunixsocketaddress.h>
+#include <gio/gunixfdlist.h>
+#endif
+
+#define GIO_COMPILATION 1
+#include "gdbusauthmechanism.h"
+#include "gdbusauthmechanismsha1.h"
+
+/* Vfunc wrappers copied from gdbusauthmechanism.c as they are not public. */
+static gboolean
+dbus_auth_mechanism_is_supported (GDBusAuthMechanism *mechanism)
+{
+ return G_DBUS_AUTH_MECHANISM_GET_CLASS (mechanism)->is_supported (mechanism);
+}
+
+static GDBusAuthMechanismState
+dbus_auth_mechanism_client_get_state (GDBusAuthMechanism *mechanism)
+{
+ return G_DBUS_AUTH_MECHANISM_GET_CLASS (mechanism)->client_get_state (mechanism);
+}
+
+static gchar *
+dbus_auth_mechanism_client_initiate (GDBusAuthMechanism *mechanism,
+ GDBusConnectionFlags conn_flags,
+ size_t *out_initial_response_len)
+{
+ return G_DBUS_AUTH_MECHANISM_GET_CLASS (mechanism)->client_initiate (mechanism,
+ conn_flags,
+ out_initial_response_len);
+}
+
+static void
+dbus_auth_mechanism_client_data_receive (GDBusAuthMechanism *mechanism,
+ const char *data,
+ size_t data_len)
+{
+ G_DBUS_AUTH_MECHANISM_GET_CLASS (mechanism)->client_data_receive (mechanism, data, data_len);
+}
+
+static char *
+dbus_auth_mechanism_client_get_reject_reason (GDBusAuthMechanism *mechanism)
+{
+ return G_DBUS_AUTH_MECHANISM_GET_CLASS (mechanism)->client_get_reject_reason (mechanism);
+}
+
+static void
+dbus_auth_mechanism_client_shutdown (GDBusAuthMechanism *mechanism)
+{
+ G_DBUS_AUTH_MECHANISM_GET_CLASS (mechanism)->client_shutdown (mechanism);
+}
+
+static void
+test_server_challenge_validation (void)
+{
+ const struct
+ {
+ const char *server_challenge;
+ const char *expected_reject_reason_prefix;
+ }
+ vectors[] = {
+ { "valid_context 123 456", "Problems looking up entry in keyring" },
+ { "invalid/context 123 456", "Malformed cookie_context" },
+ { "invalid.context 123 456", "Malformed cookie_context" },
+ { " 123 456", "Malformed cookie_context" },
+ { "\xF0\x9F\x98\x80" " 123 456", "Malformed cookie_context" },
+ { "invalid\ncontext 123 456", "Malformed cookie_context" },
+ { "invalid\rcontext 123 456", "Malformed cookie_context" },
+ { "invalid\tcontext 123 456", "Malformed cookie_context" },
+ { "invalid\\context 123 456", "Malformed cookie_context" },
+ { "valid_context 456", "Malformed cookie_id" },
+ { "valid_context 123notanumber 456", "Malformed cookie_id" },
+ { "valid_context -1 456", "Malformed cookie_id" },
+ { "valid_context 4294967296 456", "Malformed cookie_id" },
+ { "valid_context 123 ", "Malformed data" },
+ { "valid_context ", "Malformed data" },
+ };
+ GType mechanism_type;
+ GDBusConnection *connection = NULL;
+
+ g_test_summary ("Test that GDBusAuthMechanismSha1 rejects various malformed server data lines");
+
+ /* Briefly connect to the actual bus to ensure the GDBusAuth mechanisms are
+ * all registered. */
+ session_bus_up ();
+
+ connection = g_bus_get_sync (G_BUS_TYPE_SESSION, NULL, NULL);
+ g_assert_nonnull (connection);
+ g_clear_object (&connection);
+
+ session_bus_down ();
+
+ /* Check that we now have the type ID for GDBusAuthMechanismSha1 */
+ mechanism_type = g_type_from_name ("GDBusAuthMechanismSha1");
+ g_assert_cmpint (mechanism_type, !=, 0);
+
+ for (size_t i = 0; i < G_N_ELEMENTS (vectors); i++)
+ {
+ GDBusAuthMechanism *mechanism = NULL;
+ char *data = NULL;
+ size_t data_len = 0;
+ char *reject_reason = NULL;
+
+ mechanism = g_object_new (mechanism_type, NULL);
+
+ if (!dbus_auth_mechanism_is_supported (mechanism))
+ {
+ g_test_skip ("Mechanism not supported");
+ g_clear_object (&mechanism);
+ return;
+ }
+
+ data = dbus_auth_mechanism_client_initiate (mechanism,
+ G_DBUS_CONNECTION_FLAGS_AUTHENTICATION_CLIENT,
+ &data_len);
+ g_free (data);
+
+ dbus_auth_mechanism_client_data_receive (mechanism, vectors[i].server_challenge, strlen (vectors[i].server_challenge));
+
+ g_assert_cmpint (dbus_auth_mechanism_client_get_state (mechanism), ==, G_DBUS_AUTH_MECHANISM_STATE_REJECTED);
+
+ reject_reason = dbus_auth_mechanism_client_get_reject_reason (mechanism);
+ g_assert_true (g_str_has_prefix (reject_reason, vectors[i].expected_reject_reason_prefix));
+ g_free (reject_reason);
+
+ dbus_auth_mechanism_client_shutdown (mechanism);
+
+ g_clear_object (&mechanism);
+ }
+}
+
+int
+main (int argc,
+ char *argv[])
+{
+ setlocale (LC_ALL, "C");
+
+ g_test_init (&argc, &argv, G_TEST_OPTION_ISOLATE_DIRS, NULL);
+
+ g_test_dbus_unset ();
+
+ g_test_add_func ("/gdbus/auth-mechanism-sha1/server-challenge-validation", test_server_challenge_validation);
+
+ return g_test_run ();
+}
diff --git a/gio/tests/meson.build b/gio/tests/meson.build
index e7699c336..74ea481ff 100644
--- a/gio/tests/meson.build
+++ b/gio/tests/meson.build
@@ -418,6 +418,7 @@ if host_system != 'windows'
},
'fdo-notification-backend': {},
'gdbus-auth' : {'extra_sources' : extra_sources},
+ 'gdbus-auth-mechanism-sha1': {'extra_sources' : extra_sources},
'gdbus-bz627724' : {'extra_sources' : extra_sources},
'gdbus-close-pending' : {'extra_sources' : extra_sources},
'gdbus-connection' : {
--
2.35.6

4
meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb
View File

@@ -54,6 +54,10 @@ SRC_URI = "${GNOME_MIRROR}/glib/${SHRT_VER}/glib-${PV}.tar.xz \
file://CVE-2026-58012.patch \ file://CVE-2026-58012.patch \
file://CVE-2026-58013.patch \ file://CVE-2026-58013.patch \
file://CVE-2026-58014.patch \ file://CVE-2026-58014.patch \
file://CVE-2026-58015_p1.patch \
file://CVE-2026-58015_p2.patch \
file://CVE-2026-58015_p3.patch \
file://CVE-2026-58015_p4.patch \
" "
SRC_URI:append:class-native = " file://relocate-modules.patch \ SRC_URI:append:class-native = " file://relocate-modules.patch \
file://0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch \ file://0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch \

2
meta/recipes-core/glib-2.0/glib.inc
View File

@@ -39,7 +39,7 @@ PACKAGECONFIG ??= "libmount \
PACKAGECONFIG[libmount] = "-Dlibmount=enabled,-Dlibmount=disabled,util-linux" PACKAGECONFIG[libmount] = "-Dlibmount=enabled,-Dlibmount=disabled,util-linux"
PACKAGECONFIG[manpages] = "-Dman=true, -Dman=false, libxslt-native xmlto-native" PACKAGECONFIG[manpages] = "-Dman=true, -Dman=false, libxslt-native xmlto-native"
PACKAGECONFIG[libelf] = "-Dlibelf=enabled,-Dlibelf=disabled,elfutils" PACKAGECONFIG[libelf] = "-Dlibelf=enabled,-Dlibelf=disabled,elfutils"
PACKAGECONFIG[tests] = "-Dinstalled_tests=true,-Dinstalled_tests=false," PACKAGECONFIG[tests] = "-Dinstalled_tests=true,-Dinstalled_tests=false,dbus-native"
PACKAGECONFIG[selinux] = "-Dselinux=enabled,-Dselinux=disabled,libselinux" PACKAGECONFIG[selinux] = "-Dselinux=enabled,-Dselinux=disabled,libselinux"
EXTRA_OEMESON = "-Ddtrace=false -Dsystemtap=false" EXTRA_OEMESON = "-Ddtrace=false -Dsystemtap=false"