Skip to content

Commit c40fed8

Browse files
archana25-msarchana25-ms
authored
Merge branch 'main' into topic_glib-2.0
2 parents 19bd52d + 636d769 commit c40fed8

36 files changed

+3919
-194
lines changed

‎SPECS/glib/CVE-2025-14087.patch‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
From 487e062de90850689f14ca3d55cbdb9088d41bde Mon Sep 17 00:00:00 2001
2+
From: Philip Withnall <pwithnall@gnome.org>
3+
Date: Tue, 25 Nov 2025 19:02:56 +0000
4+
Subject: [PATCH] gvariant-parser: Fix potential integer overflow parsing
5+
(byte)strings
6+
7+
The termination condition for parsing string and bytestring literals in
8+
GVariant text format input was subject to an integer overflow for input
9+
string (or bytestring) literals longer than `INT_MAX`.
10+
11+
Fix that by counting as a `size_t` rather than as an `int`. The counter
12+
can never correctly be negative.
13+
14+
Spotted by treeplus. Thanks to the Sovereign Tech Resilience programme
15+
from the Sovereign Tech Agency. ID: #YWH-PGM9867-145
16+
17+
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
18+
Fixes: #3834
19+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
20+
Upstream-reference: https://gitlab.gnome.org/GNOME/glib/-/commit/3e72fe0fbb32c18a66486c4da8bc851f656af287.patch
21+
---
22+
glib/gvariant-parser.c | 10 +++++-----
23+
1 file changed, 5 insertions(+), 5 deletions(-)
24+
25+
diff --git a/glib/gvariant-parser.c b/glib/gvariant-parser.c
26+
index bb5238b..af6527d 100644
27+
--- a/glib/gvariant-parser.c
28+
+++ b/glib/gvariant-parser.c
29+
@@ -594,7 +594,7 @@ ast_resolve (AST *ast,
30+
{
31+
GVariant *value;
32+
gchar *pattern;
33+
- gint i, j = 0;
34+
+ size_t i, j = 0;
35+
36+
pattern = ast_get_pattern (ast, error);
37+
38+
@@ -1555,9 +1555,9 @@ string_free (AST *ast)
39+
* No leading/trailing space allowed. */
40+
static gboolean
41+
unicode_unescape (const gchar *src,
42+
- gint *src_ofs,
43+
+ size_t *src_ofs,
44+
gchar *dest,
45+
- gint *dest_ofs,
46+
+ size_t *dest_ofs,
47+
gsize length,
48+
SourceRef *ref,
49+
GError **error)
50+
@@ -1618,7 +1618,7 @@ string_parse (TokenStream *stream,
51+
gsize length;
52+
gchar quote;
53+
gchar *str;
54+
- gint i, j;
55+
+ size_t i, j;
56+
57+
token_stream_start_ref (stream, &ref);
58+
token = token_stream_get (stream);
59+
@@ -1748,7 +1748,7 @@ bytestring_parse (TokenStream *stream,
60+
gsize length;
61+
gchar quote;
62+
gchar *str;
63+
- gint i, j;
64+
+ size_t i, j;
65+
66+
token_stream_start_ref (stream, &ref);
67+
token = token_stream_get (stream);
68+
--
69+
2.45.4
70+

‎SPECS/glib/CVE-2025-14512.patch‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
From eaa4ef68c5ae930857e94f4c28c2fb3559b2660e Mon Sep 17 00:00:00 2001
2+
From: Philip Withnall <pwithnall@gnome.org>
3+
Date: Thu, 4 Dec 2025 16:37:19 +0000
4+
Subject: [PATCH] gfileattribute: Fix integer overflow calculating escaping for
5+
byte strings
6+
7+
The number of invalid characters in the byte string (characters which
8+
would have to be percent-encoded) was only stored in an `int`, which
9+
gave the possibility of a long string largely full of invalid
10+
characters overflowing this and allowing an attacker-controlled buffer
11+
size to be allocated.
12+
13+
This could be triggered by an attacker controlled file attribute (of
14+
type `G_FILE_ATTRIBUTE_TYPE_BYTE_STRING`), such as
15+
`G_FILE_ATTRIBUTE_THUMBNAIL_PATH` or `G_FILE_ATTRIBUTE_STANDARD_NAME`,
16+
being read by user code.
17+
18+
Spotted by Codean Labs.
19+
20+
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
21+
22+
Fixes: #3845
23+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
24+
Upstream-reference: https://gitlab.gnome.org/GNOME/glib/-/commit/4f0399c0aaf3ffc86b5625424580294bc7460404.patch
25+
---
26+
gio/gfileattribute.c | 11 +++++++++--
27+
1 file changed, 9 insertions(+), 2 deletions(-)
28+
29+
diff --git a/gio/gfileattribute.c b/gio/gfileattribute.c
30+
index 8075d1d..b14e5fa 100644
31+
--- a/gio/gfileattribute.c
32+
+++ b/gio/gfileattribute.c
33+
@@ -20,6 +20,7 @@
34+
35+
#include "config.h"
36+
37+
+#include <stdint.h>
38+
#include <string.h>
39+
40+
#include "gfileattribute.h"
41+
@@ -271,11 +272,12 @@ valid_char (char c)
42+
return c >= 32 && c <= 126 && c != '\\';
43+
}
44+
45+
+/* Returns NULL on error */
46+
static char *
47+
escape_byte_string (const char *str)
48+
{
49+
size_t i, len;
50+
- int num_invalid;
51+
+ size_t num_invalid;
52+
char *escaped_val, *p;
53+
unsigned char c;
54+
const char hex_digits[] = "0123456789abcdef";
55+
@@ -293,7 +295,12 @@ escape_byte_string (const char *str)
56+
return g_strdup (str);
57+
else
58+
{
59+
- escaped_val = g_malloc (len + num_invalid*3 + 1);
60+
+ /* Check for overflow. We want to check the inequality:
61+
+ * !(len + num_invalid * 3 + 1 > SIZE_MAX) */
62+
+ if (num_invalid >= (SIZE_MAX - len) / 3)
63+
+ return NULL;
64+
+
65+
+ escaped_val = g_malloc (len + num_invalid * 3 + 1);
66+
67+
p = escaped_val;
68+
for (i = 0; i < len; i++)
69+
--
70+
2.45.4
71+

‎SPECS/glib/glib.spec‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Summary: Low-level libraries useful for providing data structure handling for C.
33
Name: glib
44
Version: 2.71.0
5-
Release: 9%{?dist}
5+
Release: 10%{?dist}
66
License: LGPLv2+
77
Vendor: Microsoft Corporation
88
Distribution: Mariner
@@ -17,7 +17,9 @@ Patch3: CVE-2025-3360.patch
1717
Patch4: CVE-2025-4373.patch
1818
Patch5: CVE-2025-7039.patch
1919
Patch6: CVE-2025-13601.patch
20-
Patch7: CVE-2024-34397.patch
20+
Patch7: CVE-2025-14087.patch
21+
Patch8: CVE-2025-14512.patch
22+
Patch9: CVE-2024-34397.patch
2123
BuildRequires: cmake
2224
BuildRequires: gtk-doc
2325
BuildRequires: libffi-devel
@@ -131,9 +133,12 @@ touch %{buildroot}%{_libdir}/gio/modules/giomodule.cache
131133
%doc %{_datadir}/gtk-doc/html/*
132134

133135
%changelog
134-
* Mon Dec 22 2025 Archana Shettigar <v-shettigara@microsoft.com> - 2.71.0-9
136+
* Mon Dec 22 2025 Archana Shettigar <v-shettigara@microsoft.com> - 2.71.0-10
135137
- Patch CVE-2024-34397
136138

139+
* Mon Dec 15 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.71.0-9
140+
- Patch for CVE-2025-14512, CVE-2025-14087
141+
137142
* Sat Nov 29 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.71.0-8
138143
- Patch for CVE-2025-13601
139144

‎SPECS/hdf5/CVE-2025-2153.patch‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
From 4be883f34d8906bd907dcf0ddb17d47dad5357d3 Mon Sep 17 00:00:00 2001
2+
From: Glenn Song <gsong@hdfgroup.org>
3+
Date: Mon, 8 Sep 2025 17:06:52 -0500
4+
Subject: [PATCH 01/14] Add release text
5+
6+
Upstream patch Reference: https://patch-diff.githubusercontent.com/raw/HDFGroup/hdf5/pull/5795.patch
7+
---
8+
src/H5Ocache.c | 4 ++--
9+
src/H5Omessage.c | 3 +++
10+
2 files changed, 5 insertions(+), 2 deletions(-)
11+
12+
diff --git a/src/H5Ocache.c b/src/H5Ocache.c
13+
index 87f321c..12c30cf 100644
14+
--- a/src/H5Ocache.c
15+
+++ b/src/H5Ocache.c
16+
@@ -1399,8 +1399,8 @@ H5O__chunk_deserialize(H5O_t *oh, haddr_t addr, size_t chunk_size, const uint8_t
17+
else {
18+
/* Check for message of unshareable class marked as "shareable"
19+
*/
20+
- if ((flags & H5O_MSG_FLAG_SHAREABLE) && H5O_msg_class_g[id] &&
21+
- !(H5O_msg_class_g[id]->share_flags & H5O_SHARE_IS_SHARABLE))
22+
+ if (((flags & H5O_MSG_FLAG_SHARED) || (flags & H5O_MSG_FLAG_SHAREABLE)) &&
23+
+ H5O_msg_class_g[id] && !(H5O_msg_class_g[id]->share_flags & H5O_SHARE_IS_SHARABLE))
24+
HGOTO_ERROR(H5E_OHDR, H5E_CANTLOAD, FAIL,
25+
"message of unshareable class flagged as shareable");
26+
27+
diff --git a/src/H5Omessage.c b/src/H5Omessage.c
28+
index 7190e46..fb9006c 100644
29+
--- a/src/H5Omessage.c
30+
+++ b/src/H5Omessage.c
31+
@@ -354,6 +354,9 @@ H5O__msg_write_real(H5F_t *f, H5O_t *oh, const H5O_msg_class_t *type, unsigned m
32+
*/
33+
assert(!(mesg_flags & H5O_MSG_FLAG_DONTSHARE));
34+
35+
+ /* Sanity check to see if the type is not sharable */
36+
+ assert(type->share_flags & H5O_SHARE_IS_SHARABLE);
37+
+
38+
/* Remove the old message from the SOHM index */
39+
/* (It would be more efficient to try to share the message first, then
40+
* delete it (avoiding thrashing the index in the case the ref.
41+
--
42+
2.45.4
43+

‎SPECS/hdf5/CVE-2025-2310.patch‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
From 2af87ef880bf562f1607aa7b6559e5c596cc0233 Mon Sep 17 00:00:00 2001
2+
From: Matthew Larson <matthewjlar@gmail.com>
3+
Date: Wed, 24 Sep 2025 15:26:20 -0500
4+
Subject: [PATCH 1/4] Add null-termination check during attr decode
5+
6+
Upstream Patch Reference: https://patch-diff.githubusercontent.com/raw/HDFGroup/hdf5/pull/5872.patch
7+
---
8+
src/H5Oattr.c | 6 ++++++
9+
1 file changed, 6 insertions(+)
10+
11+
diff --git a/hdf5-1.14.6/src/H5Oattr.c b/hdf5-1.14.6/src/H5Oattr.c
12+
index 6d1d237..7bdaef7 100644
13+
--- a/src/H5Oattr.c
14+
+++ b/src/H5Oattr.c
15+
@@ -167,6 +167,11 @@ H5O__attr_decode(H5F_t *f, H5O_t *open_oh, unsigned H5_ATTR_UNUSED mesg_flags, u
16+
if (H5_IS_BUFFER_OVERFLOW(p, 2, p_end))
17+
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
18+
UINT16DECODE(p, name_len); /* Including null */
19+
+
20+
+ /* Verify that retrieved name length (including null byte) is valid */
21+
+ if (name_len <= 1)
22+
+ HGOTO_ERROR(H5E_OHDR, H5E_CANTDECODE, NULL, "decoded name length is invalid");
23+
+
24+
if (H5_IS_BUFFER_OVERFLOW(p, 2, p_end))
25+
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
26+
UINT16DECODE(p, attr->shared->dt_size);
27+
@@ -190,6 +195,7 @@ H5O__attr_decode(H5F_t *f, H5O_t *open_oh, unsigned H5_ATTR_UNUSED mesg_flags, u
28+
*/
29+
if (H5_IS_BUFFER_OVERFLOW(p, name_len, p_end))
30+
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
31+
+
32+
if (NULL == (attr->shared->name = H5MM_strndup((const char *)p, name_len - 1)))
33+
HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed");
34+
35+
--
36+
2.45.4
37+

‎SPECS/hdf5/CVE-2025-2914.patch‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
From 54f404b5ad8e63d99e3283646b543b2842a22fd3 Mon Sep 17 00:00:00 2001
2+
From: Binh-Minh <bmribler@hdfgroup.org>
3+
Date: Tue, 12 Aug 2025 20:06:42 -0400
4+
Subject: [PATCH] Refix of the attempts in PR-5209
5+
6+
This PR addresses the root cause of the issue by adding a sanity-check immediately
7+
after reading the file space page size from the file.
8+
9+
The same fuzzer in GH-5376 was used to verify that the assert before the vulnerability
10+
had occurred and that an error indicating a corrupted file space page size replaced it.
11+
12+
Upstream Patch Reference: https://patch-diff.githubusercontent.com/raw/HDFGroup/hdf5/pull/5722.patch
13+
---
14+
src/H5Fsuper.c | 2 ++
15+
src/H5Ofsinfo.c | 3 +++
16+
2 files changed, 5 insertions(+)
17+
18+
diff --git a/src/H5Fsuper.c b/src/H5Fsuper.c
19+
index d9fe3a7..1c8dc6c 100644
20+
--- a/src/H5Fsuper.c
21+
+++ b/src/H5Fsuper.c
22+
@@ -746,6 +746,8 @@ H5F__super_read(H5F_t *f, H5P_genplist_t *fa_plist, bool initial_read)
23+
if (!(flags & H5O_MSG_FLAG_WAS_UNKNOWN)) {
24+
H5O_fsinfo_t fsinfo; /* File space info message from superblock extension */
25+
26+
+ memset(&fsinfo, 0, sizeof(H5O_fsinfo_t));
27+
+
28+
/* f->shared->null_fsm_addr: Whether to drop free-space to the floor */
29+
/* The h5clear tool uses this property to tell the library
30+
* to drop free-space to the floor
31+
diff --git a/src/H5Ofsinfo.c b/src/H5Ofsinfo.c
32+
index 5b69235..2bb6ea6 100644
33+
--- a/src/H5Ofsinfo.c
34+
+++ b/src/H5Ofsinfo.c
35+
@@ -182,6 +182,9 @@ H5O__fsinfo_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
36+
if (H5_IS_BUFFER_OVERFLOW(p, H5F_sizeof_size(f), p_end))
37+
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
38+
H5F_DECODE_LENGTH(f, p, fsinfo->page_size); /* File space page size */
39+
+ /* Basic sanity check */
40+
+ if (fsinfo->page_size == 0 || fsinfo->page_size > H5F_FILE_SPACE_PAGE_SIZE_MAX)
41+
+ HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, NULL, "invalid page size in file space info");
42+
43+
if (H5_IS_BUFFER_OVERFLOW(p, 2, p_end))
44+
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
45+
--
46+
2.45.4
47+

‎SPECS/hdf5/CVE-2025-2924.patch‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
From 422035e1c0a30f3b363a3994e62ac46f92db9b75 Mon Sep 17 00:00:00 2001
2+
From: Glenn Song <gsong@hdfgroup.org>
3+
Date: Thu, 11 Sep 2025 16:24:33 -0500
4+
Subject: [PATCH 1/4] Add to sanity check
5+
6+
Upstream Patch Reference: https://patch-diff.githubusercontent.com/raw/HDFGroup/hdf5/pull/5814.patch
7+
---
8+
src/H5HLcache.c | 5 +++++
9+
1 file changed, 5 insertions(+)
10+
11+
diff --git a/src/H5HLcache.c b/src/H5HLcache.c
12+
index d0836fe..7f412d2 100644
13+
--- a/src/H5HLcache.c
14+
+++ b/src/H5HLcache.c
15+
@@ -225,6 +225,7 @@ H5HL__fl_deserialize(H5HL_t *heap)
16+
/* check arguments */
17+
assert(heap);
18+
assert(!heap->freelist);
19+
+ HDcompile_assert(sizeof(hsize_t) == sizeof(uint64_t));
20+
21+
/* Build free list */
22+
free_block = heap->free_block;
23+
@@ -232,6 +233,10 @@ H5HL__fl_deserialize(H5HL_t *heap)
24+
const uint8_t *image; /* Pointer into image buffer */
25+
26+
/* Sanity check */
27+
+
28+
+ if (free_block > UINT64_MAX - (2 * heap->sizeof_size))
29+
+ HGOTO_ERROR(H5E_HEAP, H5E_BADRANGE, FAIL, "decoded heap block address overflow");
30+
+
31+
if ((free_block + (2 * heap->sizeof_size)) > heap->dblk_size)
32+
HGOTO_ERROR(H5E_HEAP, H5E_BADRANGE, FAIL, "bad heap free list");
33+
34+
--
35+
2.45.4
36+

‎SPECS/hdf5/CVE-2025-2925.patch‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
From c731305ad3717924a9f48d4e4929956e80ce2cb3 Mon Sep 17 00:00:00 2001
2+
From: Glenn Song <gsong@hdfgroup.org>
3+
Date: Thu, 21 Aug 2025 11:36:23 -0500
4+
Subject: [PATCH 01/10] Fix issue5383
5+
6+
Upstream Patch Reference: https://patch-diff.githubusercontent.com/raw/HDFGroup/hdf5/pull/5739.patch
7+
---
8+
src/H5Centry.c | 9 +++++++++
9+
1 file changed, 9 insertions(+)
10+
11+
diff --git a/src/H5Centry.c b/src/H5Centry.c
12+
index 1ca7479..aedcad8 100644
13+
--- a/src/H5Centry.c
14+
+++ b/src/H5Centry.c
15+
@@ -1051,9 +1051,14 @@ H5C__load_entry(H5F_t *f,
16+
*/
17+
do {
18+
if (actual_len != len) {
19+
+ /* Verify that the length isn't a bad value */
20+
+ if (len == 0)
21+
+ HGOTO_ERROR(H5E_CACHE, H5E_BADVALUE, NULL, "len is a bad value");
22+
+
23+
if (NULL == (new_image = H5MM_realloc(image, len + H5C_IMAGE_EXTRA_SPACE)))
24+
HGOTO_ERROR(H5E_CACHE, H5E_CANTALLOC, NULL, "image null after H5MM_realloc()");
25+
image = (uint8_t *)new_image;
26+
+
27+
#if H5C_DO_MEMORY_SANITY_CHECKS
28+
H5MM_memcpy(image + len, H5C_IMAGE_SANITY_VALUE, H5C_IMAGE_EXTRA_SPACE);
29+
#endif /* H5C_DO_MEMORY_SANITY_CHECKS */
30+
@@ -1104,6 +1109,10 @@ H5C__load_entry(H5F_t *f,
31+
if (H5C__verify_len_eoa(f, type, addr, &actual_len, true) < 0)
32+
HGOTO_ERROR(H5E_CACHE, H5E_BADVALUE, NULL, "actual_len exceeds EOA");
33+
34+
+ /* Verify that the length isn't 0 */
35+
+ if (actual_len == 0)
36+
+ HGOTO_ERROR(H5E_CACHE, H5E_BADVALUE, NULL, "actual_len is a bad value");
37+
+
38+
/* Expand buffer to new size */
39+
if (NULL == (new_image = H5MM_realloc(image, actual_len + H5C_IMAGE_EXTRA_SPACE)))
40+
HGOTO_ERROR(H5E_CACHE, H5E_CANTALLOC, NULL, "image null after H5MM_realloc()");
41+
--
42+
2.45.4
43+

0 commit comments

Comments
 (0)