mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-01-29 21:08:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

glib-2.0: patch CVE-2025-7039

Browse Source 
Pick commit per [1].
Also pick commit which changed the same code before to apply it cleanly.

[1] https://security-tracker.debian.org/tracker/CVE-2025-7039

(From OE-Core rev: 79355004da104587b2fb40dcb76053431c6a6182)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Peter Marko
2025-08-24 21:07:24 +02:00
committed by Steve Sakoman
parent f8c794053b
commit b5d3231d38
3 changed files with 85 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
meta/recipes-core/glib-2.0/glib-2.0/CVE-2025-7039-01.patch Normal file
View File

@@ -0,0 +1,40 @@
From 285db475ecaa4d2cc39ce326b4c63aacb87ca6ad Mon Sep 17 00:00:00 2001
From: Alexander Kanavin <alex@linutronix.de>
Date: Tue, 22 Aug 2023 19:57:48 +0200
Subject: [PATCH] glib/gfileutils.c: use 64 bits for value in get_tmp_file()
On 32 bit systems 'long' value will overflow in 2038 and become negative.
As it is used to index into letters array, and % operation preserves signs,
data corruption will then occur.
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
CVE: CVE-2025-7039
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/285db475ecaa4d2cc39ce326b4c63aacb87ca6ad]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
glib/gfileutils.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/glib/gfileutils.c b/glib/gfileutils.c
index 9646c696e..bd3cc179a 100644
--- a/glib/gfileutils.c
+++ b/glib/gfileutils.c
@@ -1475,7 +1475,7 @@ get_tmp_file (gchar *tmpl,
static const char letters[] =
"ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
static const int NLETTERS = sizeof (letters) - 1;
- glong value;
+ gint64 value;
gint64 now_us;
static int counter = 0;
@@ -1496,7 +1496,7 @@ get_tmp_file (gchar *tmpl,
for (count = 0; count < 100; value += 7777, ++count)
{
- glong v = value;
+ gint64 v = value;
/* Fill in the random bits. */
XXXXXX[0] = letters[v % NLETTERS];

43
meta/recipes-core/glib-2.0/glib-2.0/CVE-2025-7039-02.patch Normal file
View File

@@ -0,0 +1,43 @@
From 61e963284889ddb4544e6f1d5261c16120f6fcc3 Mon Sep 17 00:00:00 2001
From: Michael Catanzaro <mcatanzaro@redhat.com>
Date: Tue, 1 Jul 2025 10:58:07 -0500
Subject: [PATCH] gfileutils: fix computation of temporary file name
We need to ensure that the value we use to index into the letters array
is always positive.
Fixes #3716
CVE: CVE-2025-7039
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/61e963284889ddb4544e6f1d5261c16120f6fcc3]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
glib/gfileutils.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/glib/gfileutils.c b/glib/gfileutils.c
index c7d3339d1..286b1b154 100644
--- a/glib/gfileutils.c
+++ b/glib/gfileutils.c
@@ -1475,9 +1475,9 @@ get_tmp_file (gchar *tmpl,
static const char letters[] =
"ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
static const int NLETTERS = sizeof (letters) - 1;
- gint64 value;
- gint64 now_us;
- static int counter = 0;
+ guint64 value;
+ guint64 now_us;
+ static guint counter = 0;
g_return_val_if_fail (tmpl != NULL, -1);
@@ -1496,7 +1496,7 @@ get_tmp_file (gchar *tmpl,
for (count = 0; count < 100; value += 7777, ++count)
{
- gint64 v = value;
+ guint64 v = value;
/* Fill in the random bits. */
XXXXXX[0] = letters[v % NLETTERS];

2
meta/recipes-core/glib-2.0/glib-2.0_2.72.3.bb
View File

@@ -62,6 +62,8 @@ SRC_URI = "${GNOME_MIRROR}/glib/${SHRT_VER}/glib-${PV}.tar.xz \
file://CVE-2025-3360-06.patch \
file://CVE-2025-4373-01.patch \
file://CVE-2025-4373-02.patch \
file://CVE-2025-7039-01.patch \
file://CVE-2025-7039-02.patch \
"
SRC_URI:append:class-native = " file://relocate-modules.patch"